# US 2014/0157352 A1 · Apparatus and method for analyzing and monitoring service advertising protocol application traffic, and information protection system using the same > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157352 A1 - Document ID: US20140157352A1 - Status: Published application - Kind: A1 - Application number: 13/734,337 - Filed: 2013-01-04 - Published: 2014-06-05 - Earliest claimed: 2012-11-30 - Assignees: Somansa Co., Ltd. - Applicants: Somansa Co., Ltd - Inventors: Seung Tae PAEK; Yong Pil HUR; Tae Wan KIM; Sang Man LEE - Web page: https://patentgrep.com/patent/US20140157352A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0254: {Stateful filtering} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Provided are a traffic analysis apparatus and method. The traffic analysis apparatus includes an analysis unit and a policy application unit. The analysis unit determines whether a network packet between at least one client and a server is a packet of a pre-registered SAP session, and, when the network packet is not the packet of the pre-registered SAP session, the analysis unit determines whether the network packet is a packet of a new SAP session. The policy application unit determines whether the network packet includes predetermined monitoring information when the network packet is the packet of the pre-registered SAP session or new SAP session and, when the network packet includes the monitoring information, the policy application unit performs a response action conforming to a predetermined security policy. ## Claims ### Claim 1 A traffic analysis apparatus, comprising: an analysis unit determining whether a network packet between at least one client and a server is a packet of a pre-registered SAP session and, when the network packet is not the packet of the pre-registered SAP session, determining whether the network packet is a packet of a new SAP session; and a policy application unit determining whether the network packet comprises predetermined monitoring information when the network packet is the packet of the pre-registered SAP session or new SAP session and, when the network packet comprises the monitoring information, performing a response action conforming to a predetermined security policy. ### Claim 2 (depends on 1) The traffic analysis apparatus of claim 1, further comprising an identification unit extracting and hashing 4-tuple of the network packet to generate a hash value, comparing the generated hash value with a hash value of 4-tuple of the pre-registered SAP session, tagging the compared result to the network packet, and transferring the tagged result to the analysis unit, wherein when the generated hash value is matched with the pre-registered hash value as the compared result, the analysis unit determines the network packet as the packet of the pre-registered SAP session. ### Claim 3 (depends on 1) The traffic analysis apparatus of claim 1, wherein the analysis unit determines whether the network packet is the packet of the new SAP session using at least one of source port information, destination port information, and signature of the network packet. ### Claim 4 (depends on 1) The traffic analysis apparatus of claim 1, wherein when the network packet is the packet of the pre-registered SAP session or new SAP session, the analysis unit classifies the network packet into request data transmitted from the client to the server and response data transmitted from the server to the client. ### Claim 5 (depends on 4) The traffic analysis apparatus of claim 4, wherein, when a transaction code is checked from the request data, the policy application unit determines whether a request corresponding to the request data is an unapproved transaction code request, on the basis of a source IP address and a user ID that are checked from the request data, and when the request is the unapproved transaction code request as the determined result, the policy application unit performs a response conforming to the security policy. ### Claim 6 (depends on 1) The traffic analysis apparatus of claim 1, wherein when the network packet is the packet of the pre-registered SAP session or new SAP session, the analysis unit parses at least one of an SAP system ID, a user ID, a name of a program for an SAP application service, a transaction code, and a message from the network packet, and objectifies the parsed result in an XML format. ### Claim 7 (depends on 6) The traffic analysis apparatus of claim 6, further comprising a management console providing an interface that reproduces the same GUI screen as a GUI screen of the client corresponding to the network packet using the objectified network packet according to a request of a manager. ### Claim 8 (depends on 1) The traffic analysis apparatus of claim 1, wherein the policy application unit performs the response action, and stores a log, comprising at least one of a history of the response action, a result conforming to the response action, and a network packet corresponding to the response action, in a database. ### Claim 9 (depends on 8) The traffic analysis apparatus of claim 8, further comprising a management console, wherein the management console provides an interface, which checks the log to check at least one of an IP address, a user ID, and a transaction code and searches change or check of abnormal data from the checked at least one, to a manager. ### Claim 10 (depends on 1) The traffic analysis apparatus of claim 1, wherein when the network packet is not the packet of the pre-registered SAP session or new SAP session, the analysis unit drops the network packet. ### Claim 11 A traffic analysis method in an apparatus for analyzing a network packet between at least one client and a server, comprising: determining whether the network packet is a packet of a pre-registered SAP session; determining whether the network packet is a packet of a new SAP session when the network packet is not the packet of the pre-registered SAP session; determining whether the network packet comprises predetermined monitoring information when the network packet is the packet of the pre-registered SAP session or new SAP session; and performing a response action conforming to a predetermined security policy when the network packet comprises the monitoring information. ### Claim 12 (depends on 11) The traffic analysis method of claim 11, further comprising dropping the network packet when the network packet is not the packet of the pre-registered SAP session or new SAP session. ### Claim 13 (depends on 11) The traffic analysis method of claim 11, further comprising: parsing at least one of an SAP system ID, a user ID, a name of a program for an SAP application service, a transaction code, and a message from the network packet when the network packet is the packet of the pre-registered SAP session or new SAP session; and objectifying the parsed result in an XML format. ### Claim 14 (depends on 13) The traffic analysis method of claim 13, further comprising reproducing and displaying the same GUI screen as a GUI screen of the client corresponding to the network packet using the objectified network packet according to a request of a manager.