Suspicious packet detection device and suspicious packet detection method thereof

A suspicious packet detection method for a suspicious packet detection device, the suspicious packet detection device comprises a storage, a network interface and a processor, the storage storing a reference file and a emulated fingerprint file, the reference file recording a HyperText Transfer Protocol (HTTP) reference header, the emulated fingerprint file recording relevance information, the suspicious packet detection method being executed by the processor and comprising:

• capturing an HTTP packet transmitted from an internal network to an external network via the network interface;
• and
• comparing an HTTP header of the HTTP packet with the HTTP reference header to determine that the HTTP packet belongs to one of a browser category and an application category and identify the HTTP packet as one of a normal packet and a suspicious packet;
• wherein when the HTTP packet is identified as the normal packet and belongs to the browser category, the suspicious packet detection method further comprises the following steps:
• determining whether destination domain information and referer information of the HTTP header are included in the relevance information;
• and
• determining whether the HTTP packet causes a count value associated with the destination domain information within a time window to exceed a first threshold when the destination domain information and the referer information are not included in the relevance information, wherein the count value is a total number of a plurality of received HTTP packets within the time window, and another destination domain information and another referer information of another HTTP header of each of the received HTTP packets are not included in the relevance information;
• and
• re-identifying the HTTP packet as the suspicious packet if the count value exceeds the first threshold.