Patent ID: 8065729

Claim:
A method of generating a network attack signature comprising: measuring byte distributions of an input packet by separating an application header from application data; and extracting an attack signature by combining the measured byte distribution of the application header with the byte distribution of the application data, wherein, in the extracting of the attack signature, the attack signature is generated by using substrings of the application data, and substrings of the application header is used as attribute classification supporting information on the generated attack signature, and wherein the measuring byte distributions step comprises: estimating an application header length according to ports or sessions; extracting the substrings from the input packet; classifying the extracted substrings into substrings of the application data and substrings of the application header by using the estimated application header length corresponding to the input packet; and updating the substrings in a header prevalence table for managing the byte distribution of the application header and in a data prevalence table for managing the byte distribution of the application data according to the classification.