Abstract: According to the present disclosure, a network protection device includes: a communication device; a storage device configured to store a white list that defines access rights between a plurality of first terminals belonging to a target network; and a control device configured to modulate an address resolution protocol (ARP) table of each of the plurality of first terminals using an ARP packet so that a first communication flow generated between the plurality of first terminals is received by the communication device, and block the first communication flow or transmit the first communication flow to a destination based on the white list when the first communication flow is received.

Abstract: A method for managing a terminal, according to one embodiment, may comprise the steps of: collecting, from packets received from a plurality of terminals connected to a network, address data of the plurality of terminals and state information indicating a network connection state of each of the plurality of terminals; obtaining, from a received ARP probe packet, a first IP address and a first MAC address of a first terminal that has transmitted the ARP probe packet; and, when address data including the same IP address and MAC address as the first IP address and the first MAC address is retrieved from among pre-stored address data, determining whether the first terminal is a stolen terminal that has copied address data of another terminal, according to the state information of a terminal having the same address data as the first IP address and the first MAC address from among the plurality of terminals.

Abstract: A method for managing a terminal, according to one embodiment, may comprise the steps of: collecting, from packets received from a plurality of terminals connected to a network, address data of the plurality of terminals and state information indicating a network connection state of each of the plurality of terminals; obtaining, from a received ARP probe packet, a first IP address and a first MAC address of a first terminal that has transmitted the ARP probe packet; and, when address data including the same IP address and MAC address as the first IP address and the first MAC address is retrieved from among pre-stored address data, determining whether the first terminal is a stolen terminal that has copied address data of another terminal, according to the state information of a terminal having the same address data as the first IP address and the first MAC address from among the plurality of terminals.

Abstract: According to the present disclosure, a network protection device includes: a communication device; a storage device configured to store a white list that defines access rights between a plurality of first terminals belonging to a target network; and a control device configured to modulate an address resolution protocol (ARP) table of each of the plurality of first terminals using an ARP packet so that a first communication flow generated between the plurality of first terminals is received by the communication device, and block the first communication flow or transmit the first communication flow to a destination based on the white list when the first communication flow is received.