Apparatus for detecting and filtering application layer DDoS Attack of web service

摘要

DDoS attack detection and response apparatus is disclosed. According to an aspect of the invention, a receiving unit that receives an HTTP request from a specific client terminal is a predetermined IP, the number of the received HTTP calculated by the IP for a predetermined observation time, and during the observation time of the HTTP URI data measurement unit for calculating the number, the number of the party compares the calculated average with a predetermined threshold and URI HTTP, the number of the party the URI HTTP DDoS the connection of the client terminal of the IP is greater than the average threshold DDoS attack detection and response equipment including a block to block packets from the IP unit to determine if the DDoS attack and the DDoS detection determination can be added to detect a DDoS attack, while minimizing the amount of computation cope with DDoS attacks and, as the target web service that the main targets of DDoS attacks is effective to perform application layer-based DDoS attack detection and response algorithm.