System and method for preventing intrusion of abnormal GTP packet

A method of preventing the intrusion of an abnormal GTP packet, the method comprising:

• monitoring a state of a system for preventing the intrusion of an abnormal GTP packet;
• changing an operation mode of the system based on the state of the system;
• storing information about a GTP packet based on the operation mode of the system;
• parsing the information about the GTP packet;
• analyzing the parsed information about the GTP packet;
• and
• determining whether to drop the GTP packet, wherein the operation mode of the system comprises an IPS mode or a bypass mode.

A method of detecting an abnormal GTP packet, the method comprising:

• classifying a GTP packet as a GTP-U packet;
• extracting a length of the GTP-U packet from the GTP-U packet;
• extracting a payload of the GTP-U packet from the GTP-U packet and extracting byte values of the payload and a length of the payload;
• and
• detecting an abnormal GTP packet based on the length of the GTP-U packet, the byte values of the payload, and the length of the payload;
• wherein the detecting of the abnormal GTP packet comprises,
• analyzing a value of first 2 bytes of the payload based on a first value;
• comparing the length of the payload with a second value;
• and
• comparing the length of the GTP-U packet with a value of 2 bytes from a third byte of the payload, wherein the first value is set based at least partially on a GTP version, and the second value is set based at least partially on an access point name (APN) field.