Apparatus and method for analyzing and monitoring sap application traffic, and information protection system using the same

A traffic analysis apparatus, comprising:

• a processor;
• an identification unit executed by the processor, extracting and hashing 4-tuple of a network packet between at least one client and a server to generate a hash value, comparing the generated hash value with a hash value of 4-tuple of a pre-registered SAP session, and tagging the compared result to the network packet;
• an analysis unit executed by the processor, determining whether the network packet between the at least one client and the server is a packet of the pre-registered SAP session based on the tagged result and, when the network packet is not the packet of the pre-registered SAP session, determining whether the network packet is a packet of a new SAP session;
• and
• a policy application unit executed by the processor, determining whether the network packet comprises predetermined monitoring information when the network packet is the packet of the pre-registered SAP session or new SAP session and, when the network packet comprises the monitoring information, performing a response action conforming to a predetermined security policy.