INTRUSION DETECTION DEVICE AND METHOD THEREOF

摘要

There is provided an intrusion detection device capable of improving the accuracy of detection of an unauthorized TCP/IP access while effectively maintaining the packet in unauthorized access analysis of the TCP/IP packet requiring assembling of packets before and after which are transmitted from another information terminal. The intrusion detection device includes a data segment assembling unit (11) and an unauthorized access analysis unit (6). When a packet from an external network is a communication by the TCP, the data segment assembling unit (11) correlates the copy of the data segment contained in the packet with the session information and temporarily holds it. When more than the payload size of the data segment same as the session information is received, the data segment assembling unit (11) assembles the data segment having the same session information. The unauthorized access analysis unit (6) analyzes the received data segment or the assembled data segment and discards the packet containing the last data segment received if an unauthorized access is contained.