A hash-based advanced multi-pattern match algorithm using a TCAM(Ternary Content Addressable Memory) is provided to support advanced multi-pattern matching by reducing the number of times of TCAM search, as supporting the advanced multi-pattern matching through a method of reducing the number of the TCAM searching times in simple way even when patterns are larger than the window size which is key length of the TCAM. In a preprocessing step, multi-attack patterns are processed to generate a TCAM entry table(401) and a TCAM associative data table(404). A scanning step is performed as follows. When packets are received, payloads of the packets are retrieved to search whether attacking patterns exist. If the attacking patterns are discovered from the payloads of the packets, the packets are processed according to execution of the TCAM associative data table(404).
展开▼
