Patent Document ID: 7565693
Application ID: 11023384
Patent Status: 1

Claim One:
1. A network intrusion detection and prevention system, the system comprising: a signature based detecting device; an anomaly behavior based detecting device; and a new signature creating and verifying device disposed between the signature based detecting device and the anomaly behavior based detecting device, wherein the anomaly behavior based detecting device is configured to detect network-attack-suspicious packets; wherein the new signature creating and verifying device comprises a signature creating and verifying unit for creating a new signature applicable to the signature based detecting device on the basis of an analyzed result of the suspicious packets, and then constructing an actual detection system environment to verify whether or not the new signature is actually applicable to the signature based detecting device; wherein the new signature creating and verifying device is configured to collect, store, and search the detected suspicious packets for common information, and is further configured to create a new signature on the basis of the searched common information and determine that the created new signature is applicable to the signature based detecting device, and register the created new signature to the signature based detecting device; and wherein the new signature creating and verifying device includes a signature testing unit configured to test the created new signature through a normal actual network traffic concurrently applied with the detected suspicious packets to test the created new signature; wherein each of the stored suspicious packets has destination/source IP address information, destination/source port number information, protocol information, and data payload information.