Apparatus and method for detecting target file based on network packet analysis

A method for detecting a target file based on network packet analysis, the method comprising:

• generating at least one file chunk by performing a chunking operation on a detection target file, and inversely indexing each of the at least one file chunk as a detection target file code;
• receiving a network packet;
• generating at least one packet chunk by performing a chunking operation on the network packet;
• generating a packet chunk query word for each of the at least one packet chunk and providing the packet chunk query word to receive the detection target file code;
• determining an identified detection target file code in the network packet based on the received detection target file code;
• receiving a series of continuously received network packets;
• and
• based on an error in a specific network packet among the series of the network packets being equal to or greater than a predetermined criterion, assuming a detection target file code of the specific network packet based on an adjacent detection target file code of an adjacent network packet of the specific network packet and not performing the chunking operation on the specific network packet.

A non-transitory computer-readable medium having embodied thereon a program, which when executed by a computer causes the computer to execute a method, the method comprising:

• generating at least one file chunk by performing a chunking operation on a detection target file, and inversely indexing each of the at least one file chunk as a detection target file code;
• receiving a network packet;
• generating at least one packet chunk by performing a chunking operation on the network packet;
• generating a packet chunk query word for each of the at least one packet chunk and providing the packet chunk query word to the inverse indexing database unit to receive the detection target file code;
• determining an identified detection target file code in the network packet based on the received detection target file code;
• receiving a series of continuously received network packets;
• and
• based on an error in a specific network packet among the series of the network packets being equal to or greater than a predetermined criterion, assuming a detection target file code of the specific network packet based on an adjacent detection target file code of an adjacent network packet of the specific network packet and determining to not perform performing the chunking operation on the specific network packet.