Patent ID: 8634717

Claim:
A Distributed Denial of Service (DDoS) attack detection and defense apparatus, comprising: a flow information collection unit configured to collect, from one or more input packets with an IP address of an attack target system as a destination IP address, flow information including source IP addresses of the input packets and packet counts of one or more flows that are classified for each of the source IP addresses and each of different protocol types; an inspection unit configured to calculate packets per second (PPS) values of the flows based on the packet counts; and a response unit configured to determine a DDoS attack response method for each of the flows based on the PPS value and the protocol type of a corresponding flow and to process the corresponding flow using the determined DDoS attack response method, wherein the response unit is further configured to determine a DDoS attack response method for a TCP flow among the flows based on a PPS value and average packet size information of the TCP wherein the response unit is further configured to perform the second and third operations by applying a higher drop probability to a TCP flow with a small average packet size than to a TCP flow with a large average packet size so that more packets may be dropped from the TCP flow with a small average packet size than from the TCP flow with a large average packet size and wherein the response unit is further configured to determine different DDoS attack response methods for different ranges of PPS values.