Intrusion detection apparatus and method using patterns
AssigneeElectronics and Telecommunications Research Institute
InventorsJae Deok Kim, Young Ho Kim, Seung Ho Ryu, Bo Heung Chung, Ki Young Kim
Life of this patent
Estimating the term…
Abstract
An intrusion detection apparatus includes: a rule generator classifying intrusion detection rules into rules having content examination parts and rules without content examination parts, granting an index to each of the rules so as to output the indices to a unit for performing the matching and to simultaneously store the indices; an extractor extracting payload parts and address parts from the packets and outputting the extracted payload parts and address parts to the unit; and an examination unit examining corresponding rules based on the indices.
Claims13
An intrusion detection apparatus using patterns, comprising:
- an extraction unit configured to extract from input packets payloads and IP addresses;
- a rule generation unit configured to classify a plurality of intrusion detection rules as first intrusion detection rules having patterns in payload parts and second intrusion detection rules without patterns in the payload parts, and further configured to generate first patterns corresponding to the first intrusion detection rules based on the patterns contained in the payload parts and second patterns corresponding to the second intrusion detection rules based on IP addresses included in the second intrusion detection rules;
- a content unit configured to perform a pattern-based examination by comparing the first patterns and the second patterns provided from the rule generating unit with the payloads and the IP addresses of the input packets provided from the extraction unit respectively, to select input packets matching with the first patterns or the second patterns;
- and
- an examination unit configured to perform a rule examination on the selected input packets by comparing the first and the second intrusion detection rules with the payloads and the IP addresses of the selected input packets.
An intrusion detection method using patterns, comprising:
- classifying a plurality of intrusion detection rules as first intrusion detection rules having patterns in payload parts and second intrusion detection rules without patterns in the payload parts;
- generate first patterns corresponding to the first intrusion detection rules based on the patterns in the payload parts;
- patternizing the second intrusion detection rules based on IP addresses included in the second intrusion detection rules to generate second patterns corresponding to the second intrusion detection rules;
- extracting from input packets payloads and IP addresses;
- performing a pattern-based examination by comparing the first patterns with the payloads of the input packets and comparing the second patterns with the IP addresses of the input packets to select input packets matching with the first patterns or the second patterns;
- and
- performing a rule-examination on the selected input packets by comparing the first and the second intrusion detection rules with the payloads and the IP addresses of the selected input packets.
Dependencies are inferred from the claim text.