Patent ID: 7818786

Claim:
A microprocessor based apparatus for managing a session state in the process of transmission control protocol (TCP) handshaking, the apparatus comprising: a session index unit producing and managing an index including 5-tuple information of a session corresponding to an input packet; a detailed information manager generating and managing an entry by extracting state information of a session in which a predetermined time does not elapse after the session has been completely established, to respond to an intrusion detection against the input packet when the index is produced, wherein the detailed information manager is configured to determine that the session is abnormal when a difference between a current hop count and a previous hop count is greater than a predetermined threshold, wherein the detailed information manager is configured to determine that the session is abnormal when a sequence number of a packet transmitted from a first host to a second host is smaller than an acknowledge number associated with a last transmitted package from the second host to the first host, wherein the detailed information manager is configured to determine that the session is abnormal when a sum of the sequence number and a payload size of the packet transmitted from a transmitting host is greater than a last acknowledge window size of the transmitting host; a brief information manager generating and managing an entry including state information, which includes states of session connection and disconnection and directionality of the input packet, of a session in which a predetermined time elapses after the session has been completely established; and a search unit searching an index of the session corresponding to the input packet in the session index unit, and, if an index does not exist, searching the brief information manager after the session has been completely established.