Patent ID: 8015610

Claim:
An intrusion detection apparatus using patterns, comprising: an extraction unit configured to extract from input packets payloads and IP addresses; a rule generation unit configured to classify a plurality of intrusion detection rules as first intrusion detection rules having patterns in payload parts and second intrusion detection rules without patterns in the payload parts, and further configured to generate first patterns corresponding to the first intrusion detection rules based on the patterns contained in the payload parts and second patterns corresponding to the second intrusion detection rules based on IP addresses included in the second intrusion detection rules; a content unit configured to perform a pattern-based examination by comparing the first patterns and the second patterns provided from the rule generating unit with the payloads and the IP addresses of the input packets provided from the extraction unit respectively, to select input packets matching with the first patterns or the second patterns; and an examination unit configured to perform a rule examination on the selected input packets by comparing the first and the second intrusion detection rules with the payloads and the IP addresses of the selected input packets.