Patent ID: 8336098

Claim:
A method of classifying received packets in a security system, the method comprising: parsing a received packet and extracting a payload from the parsed packet; scanning the payload to check whether or not a predetermined signature code is included in the payload; if it is determined from a result of the scanning that the predetermined signature code is included in the payload, generating a presumptive signature based on signature information corresponding to the predetermined signature code; extracting an actual signature corresponding to the predetermined signature code from a predetermined signature table; and determining whether or not the generated presumptive signature is identical with the actual signature corresponding to the predetermined signature code, and allocating a classification identifier (ID) to the received packet according to a result of the determination whether or not the generated presumptive signature is identical, thereby classifying the received packet according to the classification ID, wherein the predetermined signature code is formed by a part of the signature information corresponding to the predetermined signature code; wherein identification information is set for each predetermined signature code, and the generating of the presumptive signature comprises: obtaining configuration and size information of the signature information corresponding to the predetermined signature code from pre-stored information based on the identification information of the predetermined signature code, wherein the configuration information of the signature information includes a starting point of the predetermined signature code in the signature information, a length of the predetermined signature code, a length of precedent data which precedes the predetermined signature code, and a length of subsequent data that follows the predetermined signature code; extracting the precedent data from the payload based on the precedent data length information; extracting the subsequent data from the payload based on the subsequent data length information; and generating the presumptive signature by combining the extracted precedent data, the predetermined signature code, and the extracted subsequent data.