Patent ID: 7757285

Claim:
An intrusion detection and prevention system detecting a denial-of-service attack and blocking a corresponding flow, the system comprising: a storing unit storing executable instructions; and a computer processor executing the executable instructions and being configured to include: a retaining unit for retaining at least one attack suspicion threshold value and an attack determination threshold value of which levels are different from each other in order to detect the attack, a value of the attack suspicion threshold value being greater than zero; a detecting unit for detecting an attack suspicion state when a frame count in the corresponding flow of an attack detection target exceeds the attack suspicion threshold value on the retaining unit, and detecting an attack determination state when the frame count exceeds the attack determination threshold value on the retaining unit; a notifying unit for notifying of the attack suspicion state together with corresponding flow information when the attack suspicion state is detected by the detecting unit; a judging unit for judging, based on a reliability level of at least one of a frame source terminal and the corresponding flow, whether the corresponding flow is blocked or not when notified of the attack suspicion state by the notifying unit; a requesting unit for performing a screening request together with notification of the corresponding flow information when the attack determination state is detected by the detecting unit; and a screening unit for blocking the corresponding flow based on any one of screening judgment by the judging unit and, even if the judging unit judges that the corresponding flow is not blocked based on the reliability level, the screening request by the requesting unit.