# US 12,007,949 B2 · Apparatus and method for detecting target file based on network packet analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,007,949 B2 - Document ID: US12007949B2 - Status: Granted - Kind: B2 - Application number: 17/623,081 - Filed: 2021-07-22 - Published: 2022-11-17 - Granted: 2024-06-11 - Earliest claimed: 2020-11-05 - Assignees: Kookmin University Industry Academy Cooperation Foundation - Applicants: Kookmin University Industry Academy Cooperation Foundation - Inventors: Myung Keun Yoon; Jun Nyung Hur; Hyeon Gy Shon - Web page: https://patentgrep.com/patent/US12007949B2 ## CPC - G06F 16/1752: {based on file chunks} - H04L 47/36: by determining packet size, e.g. maximum transfer unit [MTU] - G06F 16/13: File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) - G06F 16/148: {File search processing} - H04L 47/43: Assembling or disassembling of packets, e.g. segmentation and reassembly [SAR] - H04L 47/27: Evaluation or update of window size, e.g. using information derived from acknowledged [ACK] packets - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An apparatus for detecting a target file includes an inverse indexing database unit configured to generate at least one file chunk by performing a chunking operation on a target file, and inversely index each of the at least one file chunk as a target file code, a network packet receiving unit configured to receive a network packet, a packet chunk processing unit configured to generate at least one packet chunk by performing a chunking operation on a network packet, a chunk query unit configured to generate a packet chunk query word for each of the at least one packet chunk and provide the packet chunk query word to the inverse indexing database unit to receive the detection target file code, and a file code determining unit configured to determine a most likely detection target file code in the network packet based on the received detection target file code. ## Claims ### Claim 1 An apparatus for detecting a target file based on network packet analysis, the apparatus comprising: an inverse indexing database unit configured to generate at least one file chunk by performing a chunking operation on a detection target file, and inversely index each of the at least one file chunk as a detection target file code; a network packet receiving unit configured to receive a network packet; a packet chunk processing unit configured to generate at least one packet chunk by performing a chunking operation on a network packet; a chunk query unit configured to generate a packet chunk query word for each of the at least one packet chunk and provide the packet chunk query word to the inverse indexing database unit to receive the detection target file code; and a file code determining unit configured to determine an identified detection target file code in the network packet based on the received detection target file code, wherein the network packet receiving unit is further configured to receive a series of continuously received network packets, wherein the packet chunk processing unit is further configured to, based on an error in a specific network packet among the series of the network packets being equal to or greater than a predetermined criterion, assume a detection target file code of the specific network packet based on an adjacent detection target file code of an adjacent network packet of the specific network packet and to not perform the chunking operation on the specific network packet, and wherein the inverse indexing database unit, the network packet receiving unit, the packet chunk processing unit, the chunk query unit, and the file code determining unit are each implemented via at least one processor. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the inverse indexing database unit is further configured to perform asymmetric extremum chunking (AE chunking) on the detection target file. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the inverse indexing database unit is further configured to chunk a character string based on an extremum detected in a local range of the detection target file and a specified window size. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the inverse indexing database unit is further configured to, when a new extremum is not detected in the specified window size, generate a corresponding file chunk. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the inverse indexing database unit is further configured to, when a new extremum is detected in the window size, defer the generating of the corresponding file chunk. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the packet chunk processing unit is further configured to, regardless of whether there is an error in the network packet, independently process the series of continuously received network packets. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the chunk query unit is further configured to generate a packet chunk bitmap for each of the at least one packet chunk and receive the detection target file code based on the packet chunk bitmap. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the file code determining unit is further configured to determine, as the identified detection target file code, a detection object file code having a highest frequency of occurrence among detection object file codes of each of the at least one packet chunk, based on integrating detection target file codes corresponding to each packet chunk for a specific data packet, and determining a corresponding detection target file code as a similar file corresponding to the specific data packet. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein the file code determining unit is further configured to, when the detection target file code having the highest frequency of occurrence constitutes a majority among detection target file codes of each of the at least one packet chunk, determine the identified detection target file code. ### Claim 10 (depends on 8) The apparatus of claim 8, wherein the file code determining unit is further configured to, when the detection target file code having the highest frequency of occurrence does not constitute a majority among detection target file codes of each of the at least one packet chunk, determining the identified detection target file code by considering adjacent network packets together. ### Claim 11 (depends on 1) The apparatus of claim 1, wherein the inverse indexing database unit is further configured to generate a chunk bitmap for each of the at least one file chunk and store the chunk bitmap in association with the detection target file code, wherein the chunk bitmap is unique identification information corresponding to the each of the at least one file chunk to form a bitmap index, and wherein each of the at least one file chunk is connected to the detection target file code through the bitmap index. ### Claim 12 A method for detecting a target file based on network packet analysis, the method comprising: generating at least one file chunk by performing a chunking operation on a detection target file, and inversely indexing each of the at least one file chunk as a detection target file code; receiving a network packet; generating at least one packet chunk by performing a chunking operation on the network packet; generating a packet chunk query word for each of the at least one packet chunk and providing the packet chunk query word to receive the detection target file code; determining an identified detection target file code in the network packet based on the received detection target file code; receiving a series of continuously received network packets; and based on an error in a specific network packet among the series of the network packets being equal to or greater than a predetermined criterion, assuming a detection target file code of the specific network packet based on an adjacent detection target file code of an adjacent network packet of the specific network packet and not performing the chunking operation on the specific network packet. ### Claim 13 (depends on 12) The method of claim 12, wherein the inversely indexing comprises generating a chunk bitmap for each of the at least one file chunk and storing the chunk bitmap in association with the detection target file code. ### Claim 14 (depends on 13) The method of claim 13, wherein the receiving of the detection target file code comprises generating a packet chunk bitmap for each of the at least one packet chunk and receiving the detection target file code based on the packet chunk bitmap. ### Claim 15 A non-transitory computer-readable medium having embodied thereon a program, which when executed by a computer causes the computer to execute a method, the method comprising: generating at least one file chunk by performing a chunking operation on a detection target file, and inversely indexing each of the at least one file chunk as a detection target file code; receiving a network packet; generating at least one packet chunk by performing a chunking operation on the network packet; generating a packet chunk query word for each of the at least one packet chunk and providing the packet chunk query word to the inverse indexing database unit to receive the detection target file code; determining an identified detection target file code in the network packet based on the received detection target file code; receiving a series of continuously received network packets; and based on an error in a specific network packet among the series of the network packets being equal to or greater than a predetermined criterion, assuming a detection target file code of the specific network packet based on an adjacent detection target file code of an adjacent network packet of the specific network packet and determining to not perform performing the chunking operation on the specific network packet.