Patent ID: 8732833

Claim:
An intrusion detection system, comprising: a first intrusion detector, configured to use a first network processor to perform intrusion detection on layer 3 and layer 4 of a protocol field, among information included in a packet header of packets transmitted to the intrusion detection system, and when no intrusion is detected, classify the packets according to stream and transmit the classified packets to a second intrusion detector; and a second intrusion detector, configured to use a second network processor to perform intrusion detection through deep packet inspection (DPI) for the packet payload of the packets transmitted from the first intrusion detector, wherein the first intrusion detector generates the streams according to a 5-tuple based on packet header information of the packets to again perform the intrusion detection on each of the generated streams when the intrusion detector for the packet header is completed, and again generates the streams according to the 2-tuple based on the packet header information of the packets to perform the classification according to stream when no intrusion is detected in each of the generated streams.