Patent Document ID: 9444828
Application ID: 14023635
Patent Flag: 1

Claim One:
1. A network intrusion detection apparatus comprising: a non-transitory computer-readable medium recording programs for realizing following functions, the functions comprising: a network processor core for receiving packets from a network, and transmitting payloads of the received packets to a Deterministic Finite Automata (DFA) engine; a detection rule converter for converting a Perl Compatible Regular Expressions (PCRE)-based detection rule, preset to detect an attack packet, into a detection rule including a pattern to which only PCRE grammar corresponding to the DFA engine is applied, so that the DFA en performs matching on a pattern including PCRE grammar supported by the DFA engine, and the network processor core performs PCRE pattern matching on a pattern to which PCRE grammar not supported by the DFA engine is applied; and the DFA engine for performing PCRE pattern matching on the payloads of the packets based on the detection rule converted by the detection rule converter, wherein the DFA engine performs PCRE pattern matching based on hardware, while the network processor core performs PCRE pattern matching based on software using PCRE library.