Abstract: The present invention relates to a multiple host-based network security device and a method for processing packet data using the network security device. The multiple host-based network security device of the present invention comprises at least two individual hosts in a single host system. Each of the individual hosts comprises individual resources such as a central processing unit (CPU) and a memory, and performs a different task in a single host system. The network security device comprises a packet policy module for providing a packet classification policy such that packet data are sent properly to the individual hosts, and a packet processing unit for sending the packet data to a relevant individual host according to the packet classification policy and providing services or blocking the packet data in accordance with packet checking results performed in the individual hosts. Thus, the data processing performance can be improved and the packet data can be stably checked.

Abstract: Disclosed herein is a network security system and method. The network security system includes a packet-dedicated processor for primarily performing hardware filtering on static attacks of network traffic, and a host system provided with a software filter for secondarily performing software filtering on dynamic attacks of network traffic. In the network security method, hardware filtering is performed on static network traffic attacks, software filtering is performed on dynamic network traffic attacks based on an analysis the results of the hardware filtering and packet streams generated by incoming packets for a predetermined time, and intrusion prevention information is provided to an administrator based on the accumulation and an analysis of the results of the software filtering.

Abstract: The present invention relates generally to a worm blocking system including a dedicated hardware-based board for performing pattern matching without a change in an existing network environment, which is installed in front of a network to be protected, inspects whether worm-related patterns exist on all packets on communication lines without loss or delay, passes packets through the system or blocks packets according to corresponding security rules and informs an administrator of results in real time, and a worm blocking method. In particular, the present invention relates to a hardware-based system and method for detecting and blocking worm-related packets which is suitable for a gigabit environment.