Patent ID: 8819807
Filing Date: 2014-08-26
Classification: H04L

Abstract:
1. A traffic analysis apparatus, comprising: a processor; an identification unit executed by the processor, extracting and hashing 4-tuple of a network packet between at least one client and a server to generate a hash value, comparing the generated hash value with a hash value of 4-tuple of a pre-registered SAP session, and tagging the compared result to the network packet; an analysis unit executed by the processor, determining whether the network packet between the at least one client and the server is a packet of the pre-registered SAP session based on the tagged result and, when the network packet is not the packet of the pre-registered SAP session, determining whether the network packet is a packet of a new SAP session; and a policy application unit executed by the processor, determining whether the network packet comprises predetermined monitoring information when the network packet is the packet of the pre-registered SAP session or new SAP session and, when the network packet comprises the monitoring information, performing a response action conforming to a predetermined security policy.