APPARATUS FOR DETECTING AND FILTERING DDOS ATTACK BASED ON DISTRIBUTION

摘要

PURPOSE: An apparatus for detecting and measuring a DDoS(Distribute Denial of Service) attack based on distribution is provided to deal with a DDoS attack while minimizing the amount of calculations. CONSTITUTION: A time distribution calculating unit(135) produces the distribution of a difference between reception time of an HTTP request. A time information comparing unit(137) compares the pre-stored normal traffic distribution information. The time information comparing unit generates the sum of distribution values which is larger than normal traffic distribution information. If the sum is larger than a predetermined threshold value, a DDoS determining unit(139) detects an access of a client terminal as a DDoS attack.