Patent ID: 7636942
Filing Date: 2009-12-22
Classification: H04L

Abstract:
1. A denial-of-service attack detecting system for detecting a denial-of-service attack on a communication device, the denial-of-service attack detecting system comprising: a monitoring device that monitors each packet transmitted to the communication device and includes a traffic abnormality detecting unit that detects traffic abnormality information indicating an abnormality of traffic based on packets transmitted to the communication device; a performance measuring device that measures response performance of the communication device based on a performance abnormality detection condition including a response time from transmission of a response request message to the communication device, to reception of a response message corresponding to the response request message, the performance measuring device being separate from and connected with the communication device and the monitoring device through a network, the performance measuring device including a performance abnormality detecting unit that detects performance abnormality information indicating an abnormality of throughput of the communication device; and an attack determining device that is connected to and performs communication with the monitoring device and the performance measuring device, the attack determining device including an effects determining unit that determines whether the communication device has received the denial-of-service attack, using both the traffic abnormality information and the performance abnormality information, and the effects determining unit determining that the communication device has received the denial-of-service attack, when it is determined that one of the traffic abnormality information and the performance abnormality information causes an occurrence of one of the traffic abnormality information and the performance abnormality information based on an abnormality occurrence time included in the traffic abnormality information and the performance abnormality information.