Patent ID: 8438639

Claim:
A DDoS attack detection and response apparatus comprising: a receiver unit receiving HTTP requests from a client terminal which is characterized as an IP address; a data measuring unit computing a number of HTTP requests by IP address and a number of URIs per HTTP over a certain time period; a DDoS discrimination unit comparing a number of HTTPs per URI with a threshold value and defining an access of the client terminal having the IP address as a DDoS attack when the number of HTTPs per URI is larger than the threshold value; and a blocking unit blocking packets from the IP address when the DDoS discrimination unit detects a DDoS attack, wherein the DDoS discrimination unit defines the access of the client terminal as the DDoS attack when an equation below is satisfied: threshold 3 < w T , s n , Wherein threshold 3 is the threshold value, w T , s = ∑ t = 1 T ⁢ ⁢ w t , s , where ω t,s is a HTTP Packet Per Second (PPS) at a unit time t from an IP address s, T is a time period, and n is a number of requested URIs during the time period T.