# US 2013/0160122 A1 · Two-stage intrusion detection system for high-speed packet processing using network processor and method thereof > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160122 A1 - Document ID: US20130160122A1 - Status: Published application - Kind: A1 - Application number: 13/452,894 - Filed: 2012-04-22 - Published: 2013-06-20 - Earliest claimed: 2011-12-15 - Assignees: Electronics and Telecommunications Research Institute - Inventors: Young-Han CHOI; Deok-Jin KIM; Sung-Ryoul LEE; Man-Hee LEE; Byung-Chul BAE; Sang-Woo PARK; E-Joong YOON - Web page: https://patentgrep.com/patent/US20130160122A1 ## CPC - H04L 63/1458: {Denial of Service} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0245: {Filtering by information in the payload} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for detecting network intrusion by using a network processor are provided. The intrusion detection system includes: a first intrusion detector, configured to use a first network processor to perform intrusion detection on layer 3 and layer 4 of a protocol field among information included in a packet header of a packet transmitted to the intrusion detection system, and when no intrusion is detected, classify the packets according to stream and transmit the classified packets to a second intrusion detector; and a second intrusion detector, configured to use a second network processor to perform intrusion detection through deep packet inspection (DPI) for the packet payload of the packets transmitted from the first intrusion detector. Thereby, intrusion detection for high-speed packets can be performed in a network environment. ## Claims ### Claim 1 An intrusion detection system, comprising: a first intrusion detector, configured to use a first network processor to perform intrusion detection on layer 3 and layer 4 of a protocol field, among information included in a packet header of packets transmitted to the intrusion detection system, and when no intrusion is detected, classify the packets according to stream and transmit the classified packets to a second intrusion detector; and a second intrusion detector, configured to use a second network processor to perform intrusion detection through deep packet inspection (DPI) for the packet payload of the packets transmitted from the first intrusion detector. ### Claim 2 (depends on 1) The intrusion detection system of claim 1, wherein the first intrusion detector drops the transmitted packets so as not to perform the deep packet inspection of the second intrusion detector when an intrusion is detected in a protocol field of layer 3 and layer 4 of the packet header. ### Claim 3 (depends on 1) The intrusion detection system of claim 1, further comprising: a plurality of second intrusion detectors connected in parallel, wherein the first intrusion detector transmits the packets to different second intrusion detectors in correspondence with classification of the packets according to stream so as to perform the deep packet inspection in parallel. ### Claim 4 (depends on 3) The intrusion detection system of claim 3, wherein the plurality of second intrusion detectors each comprise a second network processor for performing the intrusion detection through the deep packet inspection. ### Claim 5 (depends on 1) The intrusion detection system of claim 1, wherein the first intrusion detector generates the streams according to a 5-tuple based on packet header information of the packets to again perform the intrusion detection on each of the generated streams when the intrusion detector for the packet header is completed, and again generates the streams according to the 2-tuple based on the packet header information of the packets to perform the classification according to stream when no intrusion is detected in each of the generated streams. ### Claim 6 (depends on 1) The intrusion detection system of claim 1, wherein the first network processor comprises a network processor performing high-speed processing on the packet header through a micro code, and the second network processor comprises a network processor applying deep packet inspection for a packet payload. ### Claim 7 (depends on 5) The intrusion detection system of claim 5, wherein the first intrusion detector detects layer 4 DDoS and layer 7 DDoS for a source IP of the stream generated according to the 5-tuple to again perform the intrusion detection. ### Claim 8 (depends on 5) The intrusion detection system of claim 5, wherein the first intrusion detector adds a final position of the source IP address of the streams generated according to the 2-tuple to a final position of the destination IP, and then performs a modular operation thereon to perform the classification according to stream and transmit classified packets to the second intrusion detector. ### Claim 9 An intrusion detection method of an intrusion detection system including a first intrusion detector and a second intrusion detector, the intrusion detection method comprising: performing intrusion detection on layer 3 and layer 4 of a protocol field, among information included in a packet header of a packet transmitted to the intrusion detection system, by allowing the first intrusion detector to use a first network processor; classifying the packets according to stream by the first intrusion detector and transmitting the classified packets to the second intrusion detector when no intrusion is detected as a result of performing the intrusion detection; and performing intrusion detection through deep packet inspection (DPI) for a packet payload of the packet transmitted from the first intrusion detector by allowing the second intrusion detector to use a second network processor. ### Claim 10 (depends on 9) The intrusion detection method of claim 9, wherein the transmitting the packets to the second intrusion detector comprises dropping the transmitted packets so as not to perform the deep packet inspection of the second intrusion detector, when an intrusion is detected in a protocol field of layer 3 and layer 4 of the packet header. ### Claim 11 (depends on 9) The intrusion detection method of claim 9, wherein the transmitting the packets to the second intrusion detector comprises transmitting, by the first intrusion detector, the packets to any one of the plurality of second intrusion detectors included in the intrusion detection system in correspondence with the classification of the packets according to stream, and the performing of the intrusion detection through the deep packet inspection comprises performing, by the plurality of second intrusion detectors, intrusion detection in parallel through deep packet inspection. ### Claim 12 (depends on 9) The intrusion detection method of claim 9, wherein the performing the intrusion detection through the deep packet inspection comprises using, by the plurality of second intrusion detectors, a second network processor included in each of the second intrusion detectors to perform the intrusion detection in parallel through the deep packet inspection. ### Claim 13 (depends on 9) The intrusion detection method of claim 9, wherein the transmitting the packets to the second intrusion detector comprises: generating, by the first intrusion detector, the streams according to a 5-tuple based on packet header information of the packets and again performing the intrusion detection on each of the generated streams generated according to the 5-tuple, when the intrusion detection for the packet header is completed; again generating, by the first intrusion detector, the streams according to the 2-tuple based on the packet header information of the packets, when no intrusion for each of the generated streams is detected; and classifying, by the first intrusion detector, the packets according to each of the generated streams according to the 2-tuple to transmit the classified packets to the second intrusion detector. ### Claim 14 (depends on 9) The intrusion detection method of claim 9, wherein the performing the intrusion detection on the protocol field comprises: performing the intrusion detection on the protocol field of layer 3 and layer 4 among information included in the packet header of the packet transmitted to the intrusion detection system by using the first network processor performing a high-speed processing through a micro code; and the performing the intrusion detection through the deep packet inspection comprises: using, by the second intrusion detector, the second network processor applying the deep packet inspection to perform the intrusion detection through the deep packet inspection on the packet payload of the packets transmitted from the first intrusion detector. ### Claim 15 (depends on 13) The intrusion detection method of claim 13, wherein the again performing the intrusion detection on each of the generated streams generated according to 5-tuple comprises again performing the intrusion detection by detecting layer 4 DDoS and layer 7 DDoS for a source IP of the streams generated according to the 5-tuple. ### Claim 16 (depends on 13) The intrusion detection method of claim 13, wherein the transmitting the packets to the second intrusion detector comprises adding a final position of a source IP address of the streams generated according to the 2-tuple to a final position of a destination IP, and then performing a modular operation thereon to perform the classification according to stream and transmit the classified packets to the second intrusion detector.