KR20060119002A - Method for checking transmitted files in network and apparatus of enabling the method - Google Patents

Abstract

A method for checking a file transmitted through the network in network equipment and the network equipment applying the same are provided to keep the same check accuracy as file recombination while checking the file in a packet unit without recombining the file. A pattern storing part(1210) stores pattern lists to be checked in offset order of the files. A pattern includes character string information matched in a specific offset of the file. A detector(1220) detects start of file transmission by tracking a network session. A receiver(1230) receives the packets according to the start of the file transmission. A position tracker(1240) tracks which part of the file the received packet is in by referring to session information of the transmitted file. A pattern comparator(1250) compares the packet with the pattern corresponding to the offset in case that the received packet corresponds to the offset of the file. A transmission controller(1260) controls packet transmission according to a packet check result.

Description

TECHNICAL FIELD FOR CHECKING TRANSMITTED FILES IN NETWORK AND APPARATUS OF ENABLING THE METHOD}

1 is a diagram illustrating an example of a network configuration between hosts.

FIG. 2 is a diagram illustrating a case of transmitting a packet from a first host to a second host shown in FIG. 1.

3 is a diagram illustrating an example of a network configuration including a proxy.

4 is a diagram illustrating an example of a conventional file recombination test method.

5 is a diagram illustrating an example of a network configuration including a packet filter.

6 is a diagram illustrating an example of a conventional packet-based inspection method.

7 is a diagram illustrating an example of a file offset.

8 is a diagram illustrating an example of a packet offset.

9 is a diagram illustrating an example of calculating a virtual offset using a file offset in a packet.

10 is a diagram illustrating an example of a check rule corresponding to a virtual offset according to an embodiment of the present invention.

11 is a diagram illustrating an example of an email worm that is a file scan target according to an embodiment of the present invention.

12 is a diagram illustrating a configuration of network equipment according to an embodiment of the present invention.

13 is a diagram illustrating a rule table used when inspecting a file according to an embodiment of the present invention.

14 illustrates a concept of a file checking method according to an embodiment of the present invention.

15 illustrates a concept of a conventional file filtering method.

16 is a flowchart illustrating a file checking method according to an embodiment of the present invention.

FIG. 17 is a diagram illustrating an example in which a step of tracking where an offset of a packet is located in a file in the method for checking a file according to an embodiment of the present invention.

18 is a diagram illustrating an example in which a step of comparing a received packet with a pattern to be inspected corresponding to an offset in the file inspection method according to an embodiment of the present invention is specified.

<Explanation of symbols for the main parts of the drawings>

100, 300, 500: network

110, 310, 510: first host 120, 320, 520: second host

330: proxy 530: packet filter

710, 910: file offset 810, 920: packet offset

930: packet data

1200: network equipment

1210: pattern storage unit 1220: detection unit

1230: receiver 1240: location tracking unit

1250: pattern comparison unit 1260: transmission control unit

1270: transmission unit

The present invention relates to a method and an apparatus for inspecting a file transmitted over a network, and more particularly, to calculate a virtual offset of a packet transmitted over a network and to determine a packet only when there is a pattern to be inspected corresponding to the virtual offset. The present invention relates to a method and an apparatus thereof.

Threats to network security are becoming increasingly automated and intelligent. In recent years, a huge amount of security incidents continue to be caused by worms that automatically spread among these security threats.

In addition, since late 2003, e-mail worms represented by Bagle and Netsky have been causing astronomical losses. Today, much of the Internet traffic is being filled by repetitive emails sent by email worms. Many people who use the Internet and e-mail have to spend time to distinguish between normal mail and worm among the mails filled in their mailboxes, and the worm damages not only physical damage but also mental damage.

Therefore, the demand for efficient blocking of such email worms is gradually increasing.

The procedure for transferring a file in a general network is as follows.

1 and 2, when the file 210 is transmitted from the first host 110 to the second host 120 through the network 100, the packet 210 is a packet that is a transmission unit of the network 100. Transmitted separately. Data (files) exceeding the maximum transmission size of a packet that the network 100 can transmit is divided into several packets. Thus, in general, large files are divided into several packets.

For example, when the file 210 is to be transmitted from the first host 110 to the second host 120, the file 210 transmitted from the first host 110 may be configured to have a packet transmission size of the network 100. The packet is separated into small payloads and sent to the second host 120 in a payload of packets.

The packets arriving at the second host 120 are separated from the payload data 231 to 233 and reconstructed into the original file 230.

Conventionally, a file recombination scanning method has been mainly used to collect a packet and then recombine a file when a file-by-file scan is required for blocking a virus or worm or preventing confidential document leakage. The packet-based inspection method that checks as it has been used on a limited basis.

In the conventional file recombination inspection method, as illustrated in FIG. 3, a proxy 330, which is a device for inspecting a file in the network 300, is positioned in the center of the network 330 to monitor packets transmitted to the network 300. When the file transfer is detected to the network 300, the proxy 330 collects a packet corresponding to the file and stores the packet corresponding to the file in a memory (not shown). When the transmission of the original file 410 transmitted from the first host 310 is completed, the proxy 330 separates portions of the file from the packets stored in the memory and reassembles the original file. The proxy 330 inspects the recombined file 420 using an existing file inspection engine and then deletes the packets stored in the memory to block the file transfer or transmit the file in sequence.

Referring to FIGS. 3 and 4, a situation in which a file including, for example, “I love you” is transmitted from the first host 310 to the second host 320 is as follows. The inspection system included in the network transmission path of the first host 310 and the second host 320 is installed in an HTTP proxy 330 located at the gateway of the network 300 to which the first host 310 belongs. Assume that there is. All HTTP traffic leaving the network to which the first host 310 belongs passes through the proxy 330. The proxy 330 monitors the HTTP packets passing through itself, and when the file transfer starts, the proxy 330 stores the packets corresponding to the file in the memory. That is, packets including "I", "love", and "you" are stored in the memory in order of being transmitted.

When the transfer of all files from the first host 310 is completed, the proxy 330 rearranges the "I", "love", and "you" packets stored in the memory in order so that "I love you" Create an included file. Since the proxy 330 is reconstructed with the entire file to be scanned, all the scan rules may be performed on the entirety of "I love you".

After performing all of the check rules, if there is no problem with the file, the proxy 330 stores the second host (I), “love”, and “you” stored in the memory through the network 300 in order. To 320).

As described above, the conventional file recombination checking method has a high memory requirement because all the packets related to the transmitted file must be collected in the memory in order to reassemble the file in the proxy. In addition, the conventional file recombination inspection method collects all the packets from the proxy, combines the collected packets, and actually transmits them after the inspection. Therefore, transmission delay occurs and processing speed is increased due to recombination of files. There is a problem falling.

Therefore, the conventional file recombination test method is not suitable for use in network equipment that requires high processing speed.

On the other hand, the conventional packet-based inspection method is a method used in most network equipment that processes network transmission on a packet basis. Conventional packet inspection is mainly used in systems such as L2 / L3 switches, routers, packet filtering firewalls, and L7 switches. However, in the conventional packet-based inspection method, all inspection rules are designated in one packet unit, and the range of inspection is also limited to one packet. In the conventional packet-based inspection method, not only the header information recorded in the packet but also the data of the payload portion can be inspected. The payload check can also specify an offset that is indexed from the payload start point of the packet as a check option. Retrieving the payload of a packet in this way is also referred to as L7 packet filtering.

A brief description will be given of a conventional packet-based inspection method.

5 and 6, the packet filter 530 positioned between the first host 510 and the second host 520 examines all packets. When the packet filter 530 starts transmitting the file 610 from the first host 510, the packet filter 530 filters the file fragments divided into packets according to a predetermined rule and transmits the file fragments to the second host 320. The packet filter 530 blocks the packet if the content of the packet in violation of the rule is included in the transmission process. As such, the conventional packet-based inspection method may block a file transmission by blocking a corresponding packet when a transmitted packet violates a predetermined rule.

The first host 510 transmits a file including "I love you" to the network 500. At this time, the file 610 is transmitted divided into "I", "love", "you". The packet filter 530 checks the inspection rule for each packet of "I", "love", and "you". If a packet containing "you" violates a check rule, the packet filter 530 blocks the packet. Accordingly, the second host 520 receives the "I" and "love" packets, but as the "you" packet is blocked by the packet filter 530, the second host 520 may not receive the entire file (I love you). Treat it as a failure to receive a file.

As such, the conventional packet-based inspection method is a method used to inspect a packet, and thus reveals many problems when examining a file transmitted to a network. That is, the conventional packet inspection method has a problem in that it is not possible to handle a situation in which a specific pattern included in a file is divided into multiple packets. In addition, the conventional packet-based inspection method has a problem in that an offset that designates a specific position of a file cannot be used because an offset can be specified only within a packet.

The conventional packet-based inspection scheme should be blocked because the inspection rule assumes that the pattern "ove y" is found at offset 3 of the file, for example, and the file "I love you" matches this rule. However, the file filter 530 has a problem in that blocking is not possible because such a rule is not found in each packet of the packets "I", "love", and "you".

As described above, the conventional packet-based inspection method is the same as the problem that detection is not possible when all the inspection patterns are not included in one packet because the inspection is divided into several packets. Although the conventional packet-based inspection method employs an algorithm that enables inspection of a pattern divided into several packets, the accuracy is inferior because the file offset cannot be specified in the inspection rule, and the offset is not specified at all positions. There is a problem that an unnecessary inspection must be performed.

If the file offset can be specified, "ove y" is compared only once when the file's offset 710 is '3', as shown in FIG. You can't predict what size to divide, and you can't specify the offset in the packet because you don't know which part of the file is the current packet. Therefore, the conventional packet-based inspection method must continuously perform the comparison from beginning to end of every packet in a packet even when checking a pattern at a specific offset in a file. This problem ultimately incurs a great deal of computational overhead and serious performance degradation.

As such, due to accuracy and performance issues, it may be considered impossible to check a specific pattern of a file using a conventional packet-based inspection method in a network device.

On the other hand, the blocking method of the email worm according to the conventional packet inspection method cannot specify an offset in the rule of the email worm attachment and cannot predict which packet contains a pattern that violates the rule. For example, you can set a rule to search all data areas for every packet numbered 25. If there are eight check rules as shown in Fig. 15, the network must continue the comparison while proceeding through the eight check rules from beginning to end of data for every packet. This causes serious performance degradation of the network, and as the number of rules increases, processing performance continues to drop.

As described above, the conventional packet-based email scanning method in the network does not guarantee that the pattern fits in one packet because the location of the attachment is variable in the email worm, and may be spread over several packets. There is a serious problem that cannot be found. In addition, the conventional packet-based e-mail inspection method has a problem that is very likely to be a false detection because the pattern is not found at a specific offset even if the pattern is found.

Fast performance and accuracy are required to block large numbers of e-mail worms. However, the technology applied to existing networks and security devices is limited in responding to these demands.

The present invention has been made to solve the above problems, and overcomes the limitations of the file recombination check method and packet unit check method when checking a file in a network, recombining the file while checking the file by packet without recombining the file. It is an object of the present invention to provide a method and an apparatus capable of maintaining the same inspection accuracy as the above.

Another object of the present invention is to provide a method and apparatus for more quickly processing file inspection transmitted through a network.

It is still another object of the present invention to provide a method and apparatus for calculating a virtual offset of a packet transmitted through a network to determine a position of a received packet in a file.

It is still another object of the present invention to provide a method and apparatus for comparing a packet received over a network with a check pattern corresponding to the location of a file.

In the network device according to an embodiment of the present invention for achieving the above object, a method for inspecting a file transmitted through a predetermined network, a pattern list based on the offset of the file (pattern list) Storing and maintaining the pattern, wherein the pattern includes string information that must be located at a predetermined offset of the file; Detecting a start of file transfer by tracking a session of the network; Receiving a packet divided in the file in response to detecting the start of the file transfer; Tracking in which part of the file an offset of the received packet is located by referring to session information of the transmitted file; Comparing the received packet with a pattern to be inspected corresponding to the offset if the virtual offset of the received packet corresponds to an offset that is a location that needs to be tracked in the file, the virtual offset being determined by the received packet Information indicating where in the file it is located; And controlling transmission of the received packet according to the comparison result.

In addition, as a technical configuration for achieving the above object, a network device for inspecting a file in a network that transmits a file as a packet, the pattern storage unit for arranging and storing the list of patterns to be inspected based on the offset of the file The pattern includes string information that must match at a predetermined offset of the file; A detector for detecting a file transfer start by tracking a session of the network; A receiver which receives a packet according to the start of the file transfer; A location tracking unit for tracking a location of the file in which the received packet is located by referring to session information of the transmitted file; A pattern comparison unit comparing the packet corresponding to the offset when the received packet corresponds to the offset of the file; And a transmission control unit for controlling the packet transmission according to the inspection result of the pattern.

Hereinafter, a method and an apparatus for checking a file transmitted through a network will be described with reference to the accompanying drawings.

12 is a diagram illustrating a configuration of an apparatus for inspecting a file transmitted through a network according to an embodiment of the present invention. The network device 1200 includes a pattern storage unit 1210, a detection unit 1220, and a reception unit 1230. ), A location tracking unit 1240, a pattern comparison unit 1250, a transmission control unit 1260, and a transmission unit 1270.

Referring to FIG. 12, the pattern storage unit 1210 arranges and stores a pattern list to be inspected based on an offset of the file. The pattern list includes signature information corresponding to each rule as shown in FIG. 13. The signature information includes pattern information to be checked corresponding to the offset of the file. The pattern includes string information that must match at a predetermined offset of the file. The string information may be implemented in binary code.

The detector 1220 detects the start of file transfer by tracking the session of the network.

The receiver 1230 receives a packet transmitted through the network according to the start of the file transfer.

The location tracker 1240 tracks which part of the file the location of the received packet is by referring to session information of the transmitted file. The location tracking unit 1240 tracks the location of the packet by calculating a virtual offset indicating which part of the entire file is transmitted until the transmission of the file through the network is completed. The location tracker 1240 calculates a virtual offset 920 that is an offset of the file with respect to an offset of the packet by referring to session information of the transmitted file. Referring to FIG. 9, the location tracking unit 1240 may have a virtual offset 920 of data of the second packet P2 since the beginning of the second packet P2 corresponds to an offset of '2' in the entire file. Is specified as '2' through '6'. Similarly, the third packet P3 may be designated as a virtual offset from '7' to '9'. The location tracker 1240 may track which location of the entire file corresponds to the location of the packet data 930 from the virtual offset.

The pattern comparison unit 1250 compares the packet with the pattern corresponding to the offset when the received packet corresponds to the offset of the file with reference to a rule table as shown in FIG. 13. The pattern comparator 1250 improves performance by minimizing the range of rules compared in a packet by selectively comparing parts to be matched at the current offset in the rule, instead of checking the rules sequentially when checking the rules. Let's do it.

The transmission control unit 1260 controls the packet transmission according to the inspection result of the pattern.

The transmission unit 1270 transmits the packet under the control of the transmission control unit 1260.

The network equipment according to the present invention described above may be any one of a switch, a router, a firewall, an intrusion prevention system (IPS), a virus wall, and an ADSL modem.

Assume that network equipment 1200 performs four checks, for example, as shown in FIG. Referring to FIG. 10, the first rule 1010 is that the received packet is located at the beginning of the file (when the file offset or virtual offset is '0'), and "by" exists in the data of the packet corresponding to the location. Block the packet.

The second rule 1020 blocks the packet if the received packet includes a virtual offset 3 corresponding to the third offset of the file, and if "ove y" exists in the data of the packet including the virtual offset. do.

The third rule 1030 blocks the packet if the received packet includes the virtual offset 5 corresponding to the fifth offset of the file and "days" exists in the data of the packet including the virtual offset. .

The fourth rule 1040 blocks the packet if the received packet includes the virtual offset 10 corresponding to the tenth offset of the file, and "hi" exists in the data of the packet including the virtual offset. .

The procedure of inspecting a packet by applying the four rules in the network equipment according to the present invention is as follows.

10 to 12, when the network device 1200 receives the first packet P1 through the receiver 1230, the network device 1200 tracks the position of the first packet P1 through the location tracker 1240. do. The location tracking unit 1240 calculates a virtual offset of the first packet P1 by referring to the session information of the transmitted file and tracks information on which part of the file the first packet P1 is located. Since the virtual offset for the first packet P1 is '0' to '1', the network device 1200 uses the pattern comparison unit 1250 to determine the first rule 1010 and the first packet corresponding to the beginning of the file. Compare (P1). The network device 1200 blocks the transmission of the first packet P1 through the transmission control unit 1260 if a pattern corresponding to the first rule 1010 exists as a result of the comparison through the pattern comparison unit 1250. do. When the second packet P2 is received through the receiver 1230, the network device 1200 tracks the location of the received second packet P2 through the location tracker 1240. The location tracking unit 1240 uses the packet offset 910 and the session information of the file since the packet offset 910 of the second packet P2 is '0' to '4'. Compute a virtual offset 920 for. The calculated virtual offset 920 for the second packet P2 is '2' to '6'. The network device 1200 includes the second rule through the pattern comparison unit 1250 since the virtual offset 920 of the second packet P2 is included in the location information 3 to 7 corresponding to the second rule 1020. 1020 and the second packet (P2) is compared. If the word corresponding to the second rule 1020 is present according to the comparison result of the pattern comparison unit 1250, the network device 1200 blocks transmission of the second packet P2 through the transmission control unit 1260. For example, if the network device 1200 partially matches the second rule 1020, the network device 1200 stores the location of the partially matched portion of the second rule 1020 in the session information. The network equipment 1200 continues to process the next rule if it partially matches the second rule 1020. The network device 1200 processes the third packet P3 since the third rule 1030 and the second packet P2 do not match according to the comparison result of the pattern comparison unit 1250. The network device 1200 compares the second rule 1020 only with respect to “y” corresponding to the virtual offset of the third packet P3 and blocks the match. The network equipment 1200 does not compare because the fourth rule 1040 is outside the range of the virtual offset of the file to be transmitted.

On the other hand, an email worm is a worm that spreads through email and is executed on a victim's computer to send a large amount of email randomly. The email worm includes itself in the emails it sends for propagation. Therefore, in order to block the email worm, a file attached to the email should be scanned.

The structure of the email worm is as shown in FIG.

Referring to FIG. 11, header information 1110 for transmitting the email is included, and is stored in order of a MIME header 1120 and an encoded attachment file 1130.

In the SMTP protocol in which an email is transmitted, the size of the entire email is always variable because the information of servers delivering the email is added to the header of the email, and the location of the attachment in the entire email is also variable. SMTP status tracking technology is essential to block this variable email worm.

SMTP is a protocol used to send email. SMTP status tracking technology is used for accurate email worm blocking, and the mail filtering method using the SMTP status tracking technology is described in detail in the application number 10-2004-0077389 filed on September 24, 2004 by the present applicant. It is.

In order to block the email worm, it is necessary to check the attachments attached to the e-mail. The starting position of the attachment is not defined in the e-mail. Therefore, the network device according to the present invention finds the starting position of the attached file through the SMTP session tracking, and if the attached file is found, applies the packet-based file inspection method to find the email worm.

The method of finding an email worm in the attachment of the email is as shown in FIG.

Referring to FIG. 14, when the attachment of the e-mail is started, the network device 1200 needs to calculate only the virtual offset and compare only the part belonging to the virtual offset once among the rules that need to be compared in each packet. As described above, the network device 1200 bypasses all the packets of the session when the received packet exceeds the offset checked by the inspection rules. In comparison, the processing performance can be improved.

The number of comparisons according to the present invention is the same as the number of signatures, and the number of comparisons according to the conventional packet-based email checking method corresponds to the number of signatures * session data amount / average signature size.

For example, in the case of a 30KB session, 100 signatures, and a pattern length of 20 bytes, the number of comparisons according to the present invention shown in FIG. 14 is equal to the number of signatures, whereas the number of signatures according to the conventional packet unit email checking method shown in FIG. The number of comparisons is 100 * (30 * 1024) / 20 = 153,600. Therefore, the number of comparisons according to the conventional packet-based email inspection method is as much as 1,536 times compared to the comparison number according to the file inspection method of the present invention. As described above, the file checking method according to the present invention is relatively faster than the conventional scanning method as the number of comparisons is significantly reduced.

16 is a flowchart illustrating an operation for checking a file in a network device according to an embodiment of the present invention.

Referring to FIG. 16, in operation 1610, the network device stores and maintains a pattern list based on an offset of a file for a pattern to be checked. The pattern includes string information that must be located at a predetermined offset of the file. The pattern list may be configured as a hash table when there are many patterns for the same offset.

In step 1620, the network device tracks the session of the network to detect the start of file transfer.

In step 1630, the network device receives the packet divided in the file as detecting the start of the file transfer.

In step 1640, the network equipment keeps track of where the offset of the received packet is located in the file by referring to the session information of the transmitted file.

In step 1650, the network equipment determines whether the virtual offset of the received packet corresponds to a location that needs to be tracked in the file.

If the offset of the received packet is an offset corresponding to the location that needs to be tracked, in step 1660 the network equipment compares the received packet with a pattern to check corresponding to the offset. The virtual offset is information indicating in which part of the file the received packet is located. When comparing the received packet with the pattern to be checked corresponding to the offset, the network equipment calculates a hash when the hash table is configured to check only the pattern of the same hash.

In step 1670, the network equipment controls the transmission of the received packet according to the comparison result. When performing the step 1670, the network equipment bypasses all packets of the session if the virtual offset exceeds the offset of the pattern included in the pattern list.

As such, the present invention determines the location of a file with respect to the received packet and compares the inspection pattern corresponding to the identified position to perform an inspection if there is no identical packet data or there is no inspection pattern corresponding to the identified position. Since the received packet can be transmitted without performing it, the time required to perform the file check can be shortened.

FIG. 17 is a diagram illustrating an example in which a step of tracking where an offset of a packet is located in a file in the method for checking a file according to an embodiment of the present invention.

Referring to FIG. 17, in step 1710, the network equipment calculates a virtual offset of the packet with respect to the file by referring to the offset of the received packet.

In step 1720, the network equipment locates the packet in the file with the calculated virtual offset.

18 is a diagram illustrating an example in which a step of comparing a received packet with a pattern to be inspected corresponding to an offset in the file inspection method according to an embodiment of the present invention is specified.

Referring to FIG. 18, in step 1810, the network equipment detects a portion of the received packet that partially matches the pattern.

In step 1820, the network equipment compares the received packet with the remainder other than the partially matched portion in the pattern.

In step 1830, the network equipment determines whether the received packet matches the remaining portion other than the partially matched portion in the pattern.

If it matches the remaining part other than the partially matched part, in step 1840, the network equipment determines whether the received packet completely matches the pattern.

If the received packet does not fully match the pattern, that is, only partially matches the pattern, in step 1850 the network equipment stores the partial match information in session information.

Alternatively, if the received packet matches all of the patterns, in step 1860 the network equipment performs a corresponding processing operation as the received packet matches the pattern. The network equipment blocks a file containing a packet that completely matches the pattern.

On the other hand, if the comparison result does not match, in step 1870, the network equipment compares the patterns of the pattern list corresponding to the virtual offset of the received packet with the received packet.

In step 1871, the network equipment determines whether or not the pattern matches a pattern corresponding to another location (virtual offset) of the received packet.

Alternatively, if it matches the pattern, in step 1872, the network equipment determines whether the received packet and the pattern all match.

If the pattern does not match all but only partially, the network equipment stores partial match information in the session information in the same manner as in step 1850.

However, if all of the patterns match, the network equipment performs a matching processing operation on the received packet in the same manner as in step 1860.

On the other hand, if the pattern does not match, in step 1873, the network equipment performs a mismatch processing operation for delivering the received packet since the received packet does not match all of the patterns corresponding to a specific location.

Embodiments of the invention include a computer readable medium containing program instructions for performing various computer-implemented operations. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical recording media such as CD-ROMs, DVDs, magnetic-optical media such as floppy disks, and ROM, RAM, flash memory, and the like. Hardware devices specifically configured to store and execute the same program instructions are included. The medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, or the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

While specific embodiments of the present invention have been described so far, various modifications are possible without departing from the scope of the present invention.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the claims below, but also by the equivalents of the claims.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above-described embodiments, which can be variously modified and modified by those skilled in the art to which the present invention pertains. Modifications are possible. Accordingly, the spirit of the present invention should be understood only by the claims set forth below, and all equivalent or equivalent modifications thereof will belong to the scope of the present invention.

As can be seen from the above description, according to the present invention, since the packet is not recombined in memory when inspecting a file transmitted over a network, a large amount of memory is not required to store the packet and the packet is transmitted for file inspection. There is an advantage of not delaying.

In addition, according to the present invention, by checking the virtual offset of the packet transmitted over the network by the location of the received packet in the file, there is an advantage that can be more accurate file inspection.

Further, according to the present invention, there is an advantage that the time taken to inspect a file can be shortened by comparing only the inspection pattern corresponding to the location of the file with the packet received through the network.

According to the present invention, when checking a file transmitted through a network, the file can be scanned more accurately and quickly by checking the file on a packet basis by using the location information of the packet belonging to the entire session.

Claims (10)

In the method for checking a file transmitted over a predetermined network in a network device, Storing and maintaining a pattern list in which the pattern to be checked is based on an offset of a file, wherein the pattern includes string information that must be located at a predetermined offset of the file; Detecting a start of file transfer by tracking a session of the network; Receiving a packet divided in the file in response to detecting the start of the file transfer; Tracking in which part of the file an offset of the received packet is located by referring to session information of the transmitted file; Comparing the received packet with a pattern to be inspected corresponding to the offset if the virtual offset of the received packet corresponds to an offset that is a location that needs to be tracked in the file, the virtual offset being determined by the received packet Information indicating where in the file it is located; And Controlling transmission for the received packet according to the comparison result File inspection method comprising a. The method of claim 1, The step of tracking where in the file the offset of the received packet is located Calculating a virtual offset of the packet relative to the file with reference to the offset of the received packet; And Determining the location of the packet in the file with the calculated virtual offset. The method of claim 1, Comparing the received packet with the pattern to be checked corresponding to the offset, Checking whether the received packet matches the remaining portion other than the partially matched portion in the pattern when the portion of the previous packet of the received packet matches the pattern; Comparing the received packet with a pattern corresponding to a position of a file for the received packet in the pattern list if the comparison result does not match; And And storing the partial match information in the session information when the comparison results in partial matching with the pattern at the end of the packet. The method of claim 1, The controlling the transmission of the received packet according to the comparison result is And bypassing all packets of the session when the virtual offset exceeds an offset of the pattern included in the pattern list. The method of claim 1, And the pattern list comprises a hash table when there are many patterns for the same offset. The method of claim 5, Comparing the received packet with the pattern to be inspected corresponding to the offset The file checking method of claim 1, wherein the hash table is calculated to check only patterns of the same hash. The method of claim 1, The network device is a file inspection method, characterized in that any one of a switch, router, firewall, IPS, virus wall, and ADSL modem A computer-readable recording medium for recording a program for executing the method of any one of claims 1 to 7 on a computer. In the network equipment that receives a file transmitted through a predetermined network in a packet unit, A pattern storage unit arranged to store a pattern list to be checked based on an offset of the file, wherein the pattern includes string information that must match at a predetermined offset of the file; A detector for detecting a file transfer start by tracking a session of the network; A receiver which receives a packet according to the start of the file transfer; A location tracking unit for tracking a location of the file in which the received packet is located by referring to session information of the transmitted file; A pattern comparison unit comparing the packet corresponding to the offset when the received packet corresponds to the offset of the file; And A transmission control unit for controlling the packet transmission according to the inspection result of the pattern Network equipment comprising a. The method of claim 9, The network equipment is any one of a switch, a router, a firewall, an IPS, a virus wall, and an ADSL modem.

Images