KR101060959B1 - System and Method for Blocking DVD Attacks Using Ap - Google Patents

Abstract

The present invention relates to a system and method for blocking DDoS attacks using an AP. The present invention, the DDoS attack blocking system using the AP according to an embodiment of the present invention, a server that is the target of the DDoS attack of the terminal infected by the malware or malicious program to perform the DDoS attack, performs a DDoS attack blocking request Attack target server; An attack blocking server receiving the DDoS attack blocking request and generating a DDoS blocking OID and a parameter field; And receiving the DDoS blocking OID and a parameter field from the attack blocking server, and when the terminal performs the DDoS attack by transmitting a packet to the attack target server having a specific IP, the attack target server having the specific IP. And an AP for performing attack blocking against the AP, wherein the AP includes: a transceiver configured to perform data transmission / reception with the terminal and the attack blocking server; Receiving the DDoS blocking OID and parameter field from the attack blocking server, and controls the transceiver to receive the packet from the terminal, and analyzes the DDoS blocking and OID and parameter fields based on the packet for a single IP A controller which blocks an attack on the single IP when the DDoS attack is blocked, and sets a DDoS attack blocking on a specific IP section when the DDoS attack is blocked on a specific IP section; And a storage unit for receiving and storing the DDoS blocking OID and parameter fields under the control of the controller. This allows APs and attack blocking servers to work together to detect DDoS attacks, more accurately detecting DDoS attacks, and more intelligently filtering packets received from target networks that mitigate and eliminate the shortcomings associated with existing DDoS defense systems. Can be.

AP, DDoS, Attack, Block

Description

System and method for protecting DDoS attack using AP}

The present invention relates to a server protection service for a DDoS attack, and more specifically, to the DDoS attack blocking system using the AP to more accurately detect the DDoS attack by detecting the DDoS attack in cooperation with the AP and the attack blocking server and It is about a method.

Denial of Service (DoS) attacks are obvious attacks by attackers or attackers to hinder or hinder legitimate use of host computers, routers, servers, networks, and the like. While these attacks can be launched within the target network itself, most of these attacks originate from external systems and networks connected to the target via the Internet. Internet-connected devices, systems, and networks face real threats from today's rapidly expanding DoS attacks. These attacks not only damage the intended targets, but also threaten the stability of the Internet itself. While the motives for most DoS attacks still appear, for example, as computer hackers try to "show off" their anger, the DoS attacks are increasingly being used by cyber-criminals from online (internet-based) activities. There is evidence that it is being used to intimidate leading companies, and the worry is that terrorists will use DoS attacks as a means to undermine good governance by government agencies.

Large-scale traffic attacks such as denial of service attacks or distributed denial of service (DDoS) attacks are rapidly increasing the number of network disruptions around the world, and the methods and types of attacks are increasing day by day.

The most important issue facing large enterprises and service providers today is the security risks that result in paralyzing these hackers and compromising the stability and integrity of the data stored on them.

In order to solve such security risks, the introduction of firewalls and intrusion detection systems (IDS) is increasing.

However, unlike general hacking, distributed denial of service (DDoS) attacks, including denial of service (DoS) attacks, aim not only to disrupt the system but also to block services through the seizure of network resources.

Therefore, there is a problem in that an isolated solution such as a firewall or an intrusion detection system cannot solve a denial of service attack or a distributed denial of service attack.

In addition, it is not easy to detect a denial of service attack or a distributed denial of service attack, and even if such an attack is detected, there is a problem such that the corresponding source is not properly blocked.

Accordingly, in the technical field, technology development is required to effectively block DDoS attacks using APs such as routers and VoIP bases, rather than blocking distributed service denial (DDoS) attacks through terminals such as PCs.

Technical problem of the present invention devised to improve the above problems is to provide a DDoS attack blocking system and method using the AP to more accurately detect the DDoS attack by detecting the DDoS attack in cooperation with the AP and the attack blocking server will be.

According to an embodiment of the present invention, an object of the present invention is to provide a system and method for blocking DDoS attacks using an AP for more intelligent filtering of packets received in a target network that alleviates and eliminates the disadvantages associated with an existing DDoS defense system. .

According to an embodiment of the present invention, there is provided a system and method for blocking DDoS attacks using an AP for detecting DDoS attacks at appropriate points in an IP network that alleviate and eliminate the disadvantages associated with intrusion detection systems including currently available Internet firewalls. It aims to do it.

However, the objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

The DDoS attack blocking system using the AP according to an embodiment of the present invention is a server that is a target of performing a DDoS attack by a terminal infected with a malware or a malicious program and performs a DDoS attack, and a target server performing a DDoS attack blocking request. ; An attack blocking server receiving the DDoS attack blocking request and generating a DDoS blocking OID and a parameter field; And receiving the DDoS blocking OID and a parameter field from the attack blocking server, and when the terminal performs the DDoS attack by transmitting a packet to the attack target server having a specific IP, the attack target server having the specific IP. And an AP for performing attack blocking against the AP, wherein the AP includes: a transceiver configured to perform data transmission / reception with the terminal and the attack blocking server; Receiving the DDoS blocking OID and parameter field from the attack blocking server, and controls the transceiver to receive the packet from the terminal, and analyzes the DDoS blocking and OID and parameter fields based on the packet for a single IP A controller which blocks an attack on the single IP when the DDoS attack is blocked, and sets a DDoS attack blocking on a specific IP section when the DDoS attack is blocked on a specific IP section; And a storage unit for receiving and storing the DDoS blocking OID and a parameter field under the control of the controller.

delete

The controller may determine whether to change the IP setting by analyzing the DDoS blocking and the OID and the parameter field based on the packet, and when the change IP is set, change to the change IP to set the DDoS attack blocking.

The controller determines whether the predetermined time has elapsed when the DDoS attack is blocked for a preset time, and continues to block the DDoS attack on the target server when the predetermined time has not elapsed. When the preset time elapses, the DDoS attack blocking may be stopped.

The controller determines whether the DDoS block blocking stop request is received from the attack blocking server when the block is not received for the preset time, and performs the DDoS block blocking when the DDoS block stop request is not received. When the attack blocking stop request is received, the DDoS attack blocking may be stopped.

The DDoS blocking OID and parameter fields may include an OID indicating that the DDoS attack blocking packet is an identification number for the attack blocking server; A packet field indicating whether to block the single IP or the specific IP interval; an 'A' field indicates a single IP interval; A packet field indicating a changed IP that replaces the IP corresponding to the DDoS attack target, and a 'B' field indicating that there is a changed IP that replaces the IP corresponding to the DDoS attack target; A packet field indicating blocking until the DDoS attack blocking interruption request is received or until a predetermined time elapses, and when '0', blocking is performed until the DDoS attack blocking interruption request is received; C field means blocking until elapsed; A D field, which is a packet field indicating a single IP or a specific IP interval according to a value '0' or '1' of the A field; An E field which is a packet field indicating the changed IP when the value of the B field is '1'; And an F field which is a packet field indicating a preset time when the value of the C field is '1'. It may include.

DDoS attack blocking method using an AP according to an embodiment of the present invention, the attack blocking server receives a DDoS attack blocking request from the target server to generate a DDoS blocking OID and parameter fields; An AP receiving and storing the DDoS blocking OID and a parameter field from the attack blocking server; And the AP receives a DDoS attack from the target server by transmitting a packet of a terminal infected by a malicious program, and performs an attack blocking on the target server having a specific IP included in the DDoS blocking OID and a parameter field. A third step of doing; In the third step, the AP receives the DDoS blocking OID and parameter field from the attack blocking server, and receives the packet from the terminal; And when the AP analyzes the DDoS blocking and OID and parameter fields based on the packet and blocks the DDoS attack against the single IP, blocks the attack on the single IP, and blocks the DDoS attack on a specific IP section. Setting a DDoS attack blocking for a specific IP section; It may include.

delete

In the method for blocking a DDoS attack using the AP, the AP performs the third step, analyzing the DDoS blocking and the OID and the parameter field based on the packet, and determining whether to change the IP setting. Setting a DDoS attack block by changing to the changed IP when the change is made; It may further include.

In the method of blocking a DDoS attack using the AP, when the AP is blocked in the DDoS attack for a preset time, the AP determines whether the preset time has elapsed and the predetermined time has not elapsed. Continuing to block the DDoS attack on the target server, and stopping the DDoS attack blocking when the preset time elapses; It may further include.

In the method of blocking a DDoS attack using the AP, if the AP is not blocked for the preset time performed in the third step, the DDoS blocking is determined by determining whether to stop the DDoS attack blocking request from the attack blocking server. Performing the DDoS attack blocking when not receiving the stop request, and stopping the DDoS attack blocking when the DDoS attack blocking stop request is received; It may further include.

DDoS attack blocking system and method using the AP according to the present invention provides an effect that can detect the DDoS attack more accurately, by detecting the DDoS attack in cooperation with the AP and the attack blocking server.

In addition, the present invention provides an effect of more intelligently filtering packets received in a target network or the like that alleviates and eliminates the disadvantages associated with existing DDoS defense systems.

In addition, the present invention provides the effect of detecting a DDoS attack at appropriate points in an IP network that mitigates and eliminates the disadvantages associated with intrusion detection systems including currently available Internet firewalls.

Hereinafter, a detailed description of a preferred embodiment of the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, detailed descriptions of well-known functions or configurations will be omitted when it is deemed that they may unnecessarily obscure the subject matter of the present invention.

In the present specification, when one component 'transmits' data or a signal to another component, any one component may directly transmit data or a signal to another component, and at least one other component. This means that data or a signal can be transmitted to other components through the APC.

1 is a block diagram showing a DDoS attack blocking system using an AP according to an embodiment of the present invention. Referring to FIG. 1, a DDoS attack blocking system using an AP may include a terminal 100, an AP 300, an IP network 500, an attack blocking server 700, and an attack target server 900.

Terminal 100 is a broad concept including a wired terminal or a wireless terminal, a personal computer (PC), an IP television (Internet Protocol Television), a notebook-sized personal computer (PDA), a personal digital assistant (PDA), smart Phone, International Mobile Telecommunication 2000 (IMT-2000) phone, Global System for Mobile Communication (GSM) phone, General Packet Radio Service (GPRS) phone, Wideband Code Division Multiple Access (WCDMA) phone, Universal Mobile Telecommunication Service (UMTS) phone And a mobile broadband system (MBS) phone, and may be provided with a function of performing transmission and reception of data for voice and video with different terminals, a server and a system including the AP 300, and the like. The terminal 100 is infected by a malicious program such as a malicious code or a virus from another terminal or a server (not shown) to perform a DDoS attack on the target server.

The AP 300 is connected to the IP network 500 to serve as a wired LAN gateway for the terminal 100 and additionally has a routing and security function. The AP 300 receives and stores the DDoS blocking OID and parameter fields generated by the attack blocking server 700.

The AP 300 performs an attack blocking on the attack target server 900 having a specific IP according to the DDoS attack on the attack target server 900 having a specific IP by packet transmission of the terminal 100. .

The IP network 500 is a communication network which is a high-speed network of a large communication network capable of large-capacity, long-distance voice and data services, and may be a next-generation wired and wireless network for providing an Internet or high-speed multimedia service. When the IP network 500 is a mobile communication network, it may be a synchronous mobile communication network or an asynchronous mobile communication network. As an embodiment of the asynchronous mobile communication network, a WCDMA (Wideband Code Division Multiple Access) communication network is exemplified. In this case, although not shown in the figure, the IP network 500 may include a Radio Network Controller (RNC). Meanwhile, although the WCDMA network is taken as an example, it may be an IP network based on a next generation communication network such as 3G LTE network, 4G network, or other IP. The IP network 500 serves to transfer signals and data between the AP 300, the attack blocking server 700, the attack target server 900, and other systems.

The attack blocking server 700 receives a DDoS attack blocking request from the target server 900 to generate a DDoS blocking OID and a parameter field.

The attack blocking server 700 transmits the generated DDoS blocking OID and parameter fields to the AP 300.

The target server 900 is a server that is a target for performing a DDoS attack by the terminal 100. The target server 900 transmits the DDoS attack blocking request to the attack blocking server 700.

FIG. 2 is a block diagram illustrating a configuration of an AP 300 of a DDoS attack blocking system using the AP of FIG. 1. 1 and 2, the AP 300 may include a transceiver 310, a controller 330, and a storage 350.

The transceiver 310 performs wired data communication with the terminal 100 using 802.3i / 802.3u.

In addition, the transceiver 310 performs data transmission and reception with the attack blocking server 700 through the IP network 500. That is, the transceiver 310 performs a connection with the attack blocking server 700 through the IP network 500, and performs data transmission and reception through a data session connection with the connected attack blocking server 700.

That is, the transceiver 310 receives the data received from the attack blocking server 700 and transmits the data to the controller 330, and if necessary, the network device transmits data stored in the storage 350 under the control of the controller 330. Can be sent to.

The controller 330 controls the transceiver 310 to receive the DDoS blocking OID and parameter fields from the attack blocking server 700 from the attack blocking server 700. The controller 330 stores the received DDoS blocking OID and parameter fields in the storage 350.

The controller 330 controls the transceiver 310 to receive a packet from the terminal 100, and analyzes the packet based on the DDoS blocking and the OID and parameter fields stored in the storage 350 according to the packet reception. Determine whether to block the IP. If the control unit 330 determines that the blocking is for a single IP, the AP 300 blocks the attack for the single IP, and if the blocking result is the blocking of the DDoS attack for a specific IP section, the controller 330 sets the blocking of the DDoS attack for the specific IP section. do

Thereafter, the controller 330 determines whether to set the changed IP. The controller 330 sets the DDoS attack blocking by changing to the changed IP when the changed IP is set as the determination result.

The controller 330 determines whether to block for a preset time. The controller 330 determines whether or not the preset time has elapsed in the case of blocking the preset time. The controller 330 blocks the DDoS attack on the target server 900 when the predetermined time has not elapsed, and blocks the DDoS attack on the target server 900 when the predetermined time has elapsed. Abort.

On the other hand, if it is determined that the control unit 330 is not blocked for a preset time, the controller 330 determines whether the DDoS attack blocking stop request is received from the attack blocking server 700. The control unit 330 blocks the DDoS attack when the block stop request is not received as a result of the determination, and stops the DDoS attack block when the block stop request is received.

The storage unit 350 receives and stores the DDoS blocking OID and parameter fields from the attack blocking server 700 under the control of the controller 310. The storage unit 350 is a non-volatile memory (NVM), and even if power is not supplied, the storage unit 350 maintains and does not delete the stored data. The storage unit 350 is a flash memory, a magnetic random access memory (MRAM), or a PRAM ( Phase-change random access memory (PRAM), ferroelectric RAM (FRAM), and the like.

3 is a flowchart illustrating a DDoS attack blocking method using an AP according to an embodiment of the present invention. 1 to 3, the terminal 100 is infected to attack the target server by the malicious program (S1).

Simultaneously with, before or after step S1, the target server 900 transmits a DDoS attack blocking request to the attack blocking server 700 (S3).

Attack blocking server 700 generates the DDoS blocking OID and parameter fields (S5).

The attack blocking server 700 transmits the DDoS blocking OID and parameter fields generated in step S5 to the AP 300 (S7).

The AP 300 receives and stores the DDoS blocking OID and parameter fields (S9).

Thereafter, the terminal 100 performs a DDoS attack on the target server 900 having a specific IP (S11).

The AP 300 performs an attack blocking on the target server 900 having a specific IP (S13).

4 is a diagram illustrating a DDoS blocking OID and a parameter field generated by the attack blocking server 700 in step S5 of FIG. 3. 1 to 4, an object identifier (OID) 21, an A field 22, a B field 23, a C field 24, a D field 25, an E field 26, and an F field ( 27).

OID (21) is the number attached to the network identification equipment in the Simple Network Management Protocol (SNMP), and various registries, such as ANSI, are assigned a number to each manufacturer or organization using a notation similar to the IP address of the Internet Engineering Task Force (IEFT). Each manufacturer or organization is used to assign identification numbers to their equipment or software.

In one embodiment, the OID 21 may be expressed in the form of x.x.x.x.x.x.x, and may indicate that the packet is for blocking DDoS as an identification number for the attack blocking server 700.

The A field 22 is a packet field indicating whether to block a single IP or block a specific IP section. If the A field 22 is '0', it means blocking a single IP, and if '1', it means blocking a specific IP section.

The B field 23 is a packet field indicating the changed IP in place of the blocking IP. If the B field 23 is '1', it means that there is a changed IP in place of the target IP.

In other words, it means that there is a distributed server which is an emergency IP address prepared by the target server 900 during a DDoS attack against the target server 900. The modified IP is the IP address of the distributed server that can be bypassed in case of DDoS attack.

The C field 24 is a packet field indicating blocking until receiving a DDoS attack blocking stop request or until a predetermined time elapses. If the C field 24 is '0', it means blocking until the DDoS attack blocking stop request is received, and if it is '1', it means blocking until a predetermined time elapses.

The D field 25 is a packet field indicating a single IP or a specific IP interval according to '0' or '1', which is a value of the A field 22. For example, the D field 25 may be set to 211.244.110.000 when the value of the A field 22 is '0', and 211.244.110.000 to 211.244.110.244 when the value of the A field 22 is '1'. It can be set to.

The E field 26 is a packet field indicating a change IP when the value of the B field 23 is '1'. For example, the E field 26 may be set to 211.244.110.001 when the value of the B field 23 is '1'.

The F field 27 is a packet field indicating a preset time when the value of the C field 24 is '1'. For example, the F field 27 may be set to 1 hour to 2 hours when the value of the C field 24 is '1'.

5 is a flowchart showing a detailed method for step S13 of FIG. 1 to 5, in response to receiving a packet from the terminal 100, the AP 300 executes an attack blocking on the attack target server 900 (S31).

The AP 300 determines whether to block the single IP (S33).

If it is determined in step S33 that the block for the single IP, the AP 300 blocks the attack for the single IP (S35).

If it is determined in step S33 that the blocking of the single IP is not a DDoS attack for a specific IP section, the AP 300 blocks the DDoS attack for a specific IP section (S37).

After the steps S35 and S37, the AP 300 determines whether to change the IP setting (S39).

As a result of the determination in step S39, when the changed IP is set, the AP 300 changes to the changed IP to set the DDoS attack blocking (S41).

On the other hand, after step S41 or when the determination result of step S39 is not set to change IP, the AP 200 determines whether to block for a preset time (S43).

As a result of the step (S43), in case of blocking for the preset time, the AP 300 determines whether the preset time has elapsed (S45).

As a result of the determination in step S45, when the preset time has not elapsed, the AP 300 blocks the DDoS attack on the target server 900 (S47), and returns to step S43. Meanwhile, as a result of the determination in step S45, the AP 300 stops blocking the DDoS attack on the target server 900 when a predetermined time elapses (S49).

On the other hand, in step S43 again, if the result of step S43 does not block for a preset time, the AP 300 determines whether a DDoS attack blocking stop request is received from the attack blocking server 700 (S51).

If it is determined in step S51 that the blocking stop request is not received, the AP 300 performs the DDoS attack blocking (S53), and returns to step S51. On the other hand, when receiving the blocking stop request as a result of the determination in step S51 AP (300) stops blocking the DDoS attack (S55).

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and also implemented in the form of a carrier wave (for example, transmission over the Internet). It also includes.

The computer readable recording medium can also be injected onto a networked computer system so that the computer readable code is stored and executed in a distributed fashion. And functional programs, codes and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

Although the contents of the present invention have been described with reference to one embodiment shown in the drawings, this is merely exemplary, and those skilled in the art may realize various modifications and other equivalent embodiments therefrom. Will understand. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

By using the DDoS attack blocking system and method using the AP of the present invention, the AP and the attack blocking server cooperate to detect the DDoS attack, thereby more accurately detecting the DDoS attack and mitigating and eliminating the disadvantages associated with the existing DDoS defense system. A technique for more intelligently filtering packets received in a target network or the like may be provided.

BRIEF DESCRIPTION OF THE DRAWINGS In order to better understand the drawings cited in the detailed description of the invention, a brief description of each drawing is provided.

1 is a block diagram showing a DDoS attack blocking system using an AP according to an embodiment of the present invention.

Figure 2 is a block diagram showing the configuration of the AP of the DDoS attack blocking system using the AP of FIG.

3 is a flowchart illustrating a DDoS attack blocking method using an AP according to an embodiment of the present invention.

4 is a diagram illustrating a DDoS blocking OID and a parameter field generated by an attack blocking server in step S5 of FIG.

FIG. 5 is a flow chart showing a detailed method for step S13 of FIG.

<Description of the symbols for the main parts of the drawings>

100: terminal 300: AP

310: transceiver 330: controller

350: storage unit 500: IP network

700: attack blocking server 900: target server

Claims (12)

A server that is a target of performing a DDoS attack of a terminal infected with a malware or a malicious program and performing a DDoS attack, the target server performing a DDoS attack blocking request; An attack blocking server receiving the DDoS attack blocking request and generating a DDoS blocking OID and a parameter field; And Receiving the DDoS blocking OID and the parameter field from the attack blocking server, when the terminal performs the DDoS attack by packet transmission to the target server having a specific IP, to the target server having the specific IP AP for performing the attack blocking; The AP, Transmitting and receiving unit for performing data transmission and reception with the terminal and the attack blocking server; Receiving the DDoS blocking OID and parameter field from the attack blocking server, and controls the transceiver to receive the packet from the terminal, and analyzes the DDoS blocking and OID and parameter fields based on the packet for a single IP A controller which blocks an attack on the single IP when the DDoS attack is blocked, and sets a DDoS attack blocking on a specific IP section when the DDoS attack is blocked on a specific IP section; And A storage unit for receiving and storing the DDoS blocking OID and parameter fields under the control of the controller; DDoS attack blocking system using an AP comprising a. delete The method of claim 1, wherein the control unit, Based on the packet, the DDoS blocking and the OID and the parameter field are analyzed to determine whether to change the IP setting, and when the IP is set, the IP is changed to change to the changed IP to set the DDoS attack blocking. DDoS attack blocking system. The method of claim 3, wherein the control unit, In case of blocking the DDoS attack for a preset time, it is determined whether the preset time has elapsed, and if the preset time has not elapsed, the DDoS attack blocking for the target server is continuously performed, and the preset time is DDoS attack blocking system using the AP, characterized in that to stop the DDoS attack blocking when elapsed. The method of claim 4, wherein the control unit, If it is not the blocking for the preset time, it is determined whether the DDoS attack blocking stop request is received from the attack blocking server. DDoS attack blocking system using the AP, characterized in that to stop the DDoS attack blocking if received. The method of claim 5, wherein the DDoS blocking OID and parameter field, An OID indicating a packet for blocking the DDoS attack as an identification number for the attack blocking server; A packet field indicating whether to block the single IP or the specific IP interval; an 'A' field indicates a single IP interval; A packet field indicating a changed IP that replaces the IP corresponding to the DDoS attack target, and a 'B' field indicating that there is a changed IP that replaces the IP corresponding to the DDoS attack target; A packet field indicating blocking until the DDoS attack blocking interruption request is received or until a predetermined time elapses, and when '0', blocking is performed until the DDoS attack blocking interruption request is received; C field means blocking until elapsed; A D field, which is a packet field indicating a single IP or a specific IP interval according to a value '0' or '1' of the A field; An E field which is a packet field indicating the changed IP when the value of the B field is '1'; And An F field that is a packet field indicating a preset time when the value of the C field is '1'; DDoS attack blocking system using an AP comprising a. A first step of the attack blocking server receiving a DDoS attack blocking request from the target server to generate a DDoS blocking OID and a parameter field; An AP receiving and storing the DDoS blocking OID and a parameter field from the attack blocking server; And The AP receives a DDoS attack to the target server by transmitting a packet of a terminal infected by a malicious program, and performs an attack blocking on the target server having a specific IP included in the DDoS blocking OID and a parameter field. Perform the third step; The third step, Receiving, by the AP, the DDoS blocking OID and a parameter field from the attack blocking server and receiving the packet from the terminal; And When the AP blocks the DDoS attack against the single IP by analyzing the DDoS blocking and OID and parameter fields based on the packet, and blocks the attack against the single IP, and the DDoS attack blocking against a specific IP section. A DDoS attack blocking method using an AP comprising: setting a DDoS attack blocking for a specific IP section. delete 8. The process of claim 7 performed in the third step. Determining, by the AP, the DDoS blocking and the OID and the parameter field based on the packet to determine whether to change the IP setting, and setting the DDoS attack blocking by changing to the changing IP when the change IP is set; DDoS attack blocking method using an AP characterized in that it further comprises. 10. The process of claim 9 performed in the third step. The AP determines whether the preset time has elapsed when the DDoS attack is blocked for a preset time. If the preset time has not elapsed, the AP continues to block the DDoS attack on the target server. Stopping the DDoS attack blocking when a predetermined time elapses; DDoS attack blocking method using an AP characterized in that it further comprises. The method of claim 10, wherein the third step is performed, If the AP is not blocking for the preset time, it is determined whether the DDoS attack blocking stop request is received from the attack blocking server, and when the DDoS blocking stop request is not received, the DDoS attack blocking is performed, and the DDoS Stopping the DDoS attack blocking when receiving an attack blocking stop request; DDoS attack blocking method using an AP characterized in that it further comprises. The method of claim 11, wherein the DDoS blocking OID and parameter field, An OID indicating a packet for blocking the DDoS attack as an identification number for the attack blocking server; A packet field indicating whether to block the single IP or the specific IP interval; an 'A' field indicates a single IP interval; A packet field indicating a changed IP that replaces the IP corresponding to the DDoS attack target, and a 'B' field indicating that there is a changed IP that replaces the IP corresponding to the DDoS attack target; A packet field indicating blocking until the DDoS attack blocking interruption request is received or until a predetermined time elapses, and when '0', blocking is performed until the DDoS attack blocking interruption request is received; C field means blocking until elapsed; A D field, which is a packet field indicating a single IP or a specific IP interval according to a value '0' or '1' of the A field; An E field, which is a packet field indicating the changed IP when the value of the B field is '1'; And An F field that is a packet field indicating a preset time when the value of the C field is '1'; DDoS attack blocking method using an AP comprising a.

Images