US 2013/0160122 A1 · TWO-STAGE INTRUSION DETECTION SYSTEM FOR HIGH-SPEED PACKET PROCESSING USING NETWORK PROCESSOR AND METHOD THEREOF

Abstract

A system and method for detecting network intrusion by using a network processor are provided. The intrusion detection system includes: a first intrusion detector, configured to use a first network processor to perform intrusion detection on layer 3 and layer 4 of a protocol field among information included in a packet header of a packet transmitted to the intrusion detection system, and when no intrusion is detected, classify the packets according to stream and transmit the classified packets to a second intrusion detector; and a second intrusion detector, configured to use a second network processor to perform intrusion detection through deep packet inspection (DPI) for the packet payload of the packets transmitted from the first intrusion detector. Thereby, intrusion detection for high-speed packets can be performed in a network environment.

Claims16

Dependent claims

An intrusion detection system, comprising:

a first intrusion detector, configured to use a first network processor to perform intrusion detection on layer 3 and layer 4 of a protocol field, among information included in a packet header of packets transmitted to the intrusion detection system, and when no intrusion is detected, classify the packets according to stream and transmit the classified packets to a second intrusion detector;
and
a second intrusion detector, configured to use a second network processor to perform intrusion detection through deep packet inspection (DPI) for the packet payload of the packets transmitted from the first intrusion detector.

An intrusion detection method of an intrusion detection system including a first intrusion detector and a second intrusion detector, the intrusion detection method comprising:

performing intrusion detection on layer 3 and layer 4 of a protocol field, among information included in a packet header of a packet transmitted to the intrusion detection system, by allowing the first intrusion detector to use a first network processor;
classifying the packets according to stream by the first intrusion detector and transmitting the classified packets to the second intrusion detector when no intrusion is detected as a result of performing the intrusion detection;
and
performing intrusion detection through deep packet inspection (DPI) for a packet payload of the packet transmitted from the first intrusion detector by allowing the second intrusion detector to use a second network processor.

1 more element

Dependencies are inferred from the claim text.

Facts

Application

13/452,894Filed 22 Apr 2012

Priority

KR 10-2011-013592615 Dec 2011

Published

20 Jun 2013

Term ends

Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/1458
Countermeasures against malicious traffic: denial of Service
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/0245
Filtering policies: filtering by information in the payload

Two-stage intrusion detection system for high-speed packet processing using network processor and method thereof

Life of this patent

Two-stage intrusion detection system for high-speed packet processing using network processor and method thereof

Life of this patent

Abstract

Claims16