Patent ID: 9230102
Filing Date: 2016-01-05
CPC Classification: G06F,H04L

Claim Text:
1. An apparatus for detecting a traffic flooding attack and conducting an in-depth analysis using data mining, the apparatus comprising: a generator that generates a management information base (MIB) based on network traffic data; a sensor that determines, by collecting the MIB, a point in time at which a detection system is operated; a storage that stores an MIB determined by the detection system analyzing the MIB; an attack determiner that determines whether an attack is detected and a type of the attack, based on the determined MIB; and an offline processor configured to both randomly generate various traffic attacks to execute a C4.5-based learning, and to conduct an in-depth semantic interpretation that extracts and analyzes data characteristics of data stored in the storage in a form of rule, the rule associated with the C4.5-based learning and the in-depth semantic interpretation comprising a selection and reduction processes using “IF-THEN” algorithm corresponding to types of traffic flooding attacks, the selection and reduction being performed using association rule mining by calculating conditional probability of entropy between a target class and attributes comprising X and Y, the calculation being performed based on determination whether or not the attribute Y being highly or repeatedly distributed, correlated, or occurred when the attribute X is given, wherein a number of meaningless rules are generated according to the determination if attribute Y being rarely distributed, correlated, or occurred when the attribute X is given, and wherein the offline processor is connected to one network and receives the monitoring network traffic data from the one network.