PSEUDO PACKET MONITORING SYSTEM FOR ADDRESS RESOLUTION PROTOCOL SPOOFING MONITORING OF MALICIOUS CODE AND PSEUDO PACKET MONITORING METHOD THEREFOR

摘要

PURPOSE: A virtual packet monitoring system and method thereof are provided to easily determine the occurrence of an ARP(Address Resolution Protocol) spoofing by comparing ARP information within the SNMP(Simple Network Management Protocol) information of apparatuses. CONSTITUTION: A first ARP information extraction module(100) extracts first ARP information for apparatuses connected to a network of a host PC(Personal Computer). A second ARP information extraction module(200) constructs a virtual network in the host PC. The second ARP information extraction module extracts second ARP information within the SNMP information of the apparatus connected to the virtual network. An ARP information comparison module(300) determines the occurrence of an ARP spoofing attack by comparing the first ARP information with the second ARP information.