Electronics and Telecommunications Research Institute

Seung Ho Ryu

Ki Young Kim

Young Ho Kim

Bo Heung Chung

Jae Deok Lim

Sang Woo Lee

Yong Sung Jeon

Jae Deok Kim

An intrusion detection apparatus includes: a rule generator classifying intrusion detection rules into rules having content examination parts and rules without content examination parts, granting an index to each of the rules so as to output the indices to a unit for performing the matching and to simultaneously store the indices; an extractor extracting payload parts and address parts from the packets and outputting the extracted payload parts and address parts to the unit; and an examination unit examining corresponding rules based on the indices.

Intrusion detection apparatus and method using patterns

A method of blocking network attacks using information included in a packet, and an apparatus thereof are provided. The method includes: receiving a packet containing information on the packet including at least information on a source from which the packet is sent, and information on a destination to which the packet is sent; and extracting the information on the packet included in the packet, comparing the information with a predetermined access control condition, and blocking or passing the packet. By doing so, a packet being transferred with a routing header capable of bypassing a security device as in an Internet Protocol version 6 (IPv6) network can be appropriately blocked or passed. Accordingly, security problems caused by the routing header can be overcome, and as a result, usage of the routing header can be promoted. Also, since a routing header can be used for transmitting a packet along a desired path, the routing header can be widely used without security problems, and can ease network security concerns relating to IPv6 networks that are expected to come into increasingly wide use.

Method of blocking network attacks using packet information and apparatus thereof

Provided is a method of generating and searching for a single ternary content addressable memory (TCAM) entry for range search and exact-match search. First, it is determined whether an entry to be added is a range search entry or an exact-match search entry. When the entry is the range search entry, a bit at a predetermined position in the upper m bits corresponding to a range represented by the entry is set to '1' and the remaining bits including lower n bits is set to a 'don't care' bit x, based on a range table for representing position information of one of the upper m bits which is set to &#x201c;1&#x201d; in ranges. When the entry is the exact-match search entry, the upper m bits is set to &#x201c;don't care&#x201d; bit x and the lower n bits is set to the entry value. By generating and searching for a single TCAM entry for a range search and an exact-match search, a space for storing the TCAM entry can be optimized and efficiency thereof can be improved.

Method of generating TCAM entry and method and apparatus for searching for TCAM entry

Growing community of inventors

Seoul, South Korea

Seung Ho Ryu