摘要:
Provided is a DDoS attack detection apparatus including an information collecting unit to collect DDoS detection information including rate information about traffic change, variation of a first type flow and a Packet Per Second (PPS) for a second type flow, in which the rate information about traffic change is obtained using packet count of packets input per a unit time, flow count of flows input per the unit time and the byte count of bytes input per the unit time; and a testing unit to calculate a probability of occurrence of the DDoS attack by use of a first probability determined by the rate information about traffic change, a second probability determined by the variation of the first type flow and a third probability determined by the PPS for the second type flow and detect occurrence of the DDoS attack based on the probability of occurrence of the DDoS attack.
摘要翻译:提供了一种DDoS攻击检测装置,其包括:信息收集单元,用于收集关于流量变化的速率信息,第一类型流的变化和第二类型流的每秒包(Packet Per Second,PPS)的DDoS检测信息,其中关于 使用每单位时间输入的分组的分组计数,每单位时间输入的流量流量和每单位时间输入的字节数字获得流量变化; 以及测试单元,通过使用由关于业务变化的速率信息确定的第一概率来计算DDoS攻击的发生概率,由第一类型流的变化确定的第二概率和由PPS确定的第三概率,用于 根据DDoS攻击的发生概率,第二类流检测DDoS攻击的发生。
摘要:
A router having a black box function capable of storing a data block of a specific node or node group in a network, and a network system including the router are provided. The router includes: a black box memory storing node data; at least one packet preprocessor selecting and processing a data packet required to be stored in a black box from node data transferred via a wired/wireless transmission medium; a data storage storing the node data transferred through the packet preprocessor in the black box memory; a data reader reading corresponding node data in response to a node data transfer request from an external device; and a data transmitter processing the node data read by the data reader in the form of a packet and transferring the packet to the external device.