KR20040057257A - System and method for protecting from ddos, and storage media having program thereof - Google Patents

Abstract

PURPOSE: A system and a method for confronting a DDoS(Distributed Denial of Service) attack, and a recording medium recording a program for the same are provided to control a network connection device by detecting the DDoS attack, confront system breakdown and network resource loss, and guarantee the stable operation of the system by blocking the DDoS attack at a backbone. CONSTITUTION: A statistics database(200) stores traffic statistics values. A confrontation server(100) judges abnormality by collecting traffic information from the network connection devices(10,20,30), judges that the abnormal traffic is attacked by the DDoS attack, and applies a traffic migration limit to the network connection device attacked by the DDoS attack. The confrontation server comprises a detecting tool(110) and a confronting tool(120).

Description

SYSTEM AND METHOD FOR PROTECTING FROM DDOS, AND STORAGE MEDIA HAVING PROGRAM THEREOF}

The present invention provides a distributed service denial attack response system and method for detecting a distributed service denial attack and control a network connection device, and a recording medium storing the program.

Massive traffic attacks, such as denial of service (DoS) attacks and distributed denial of service (DDoS) attacks, are rapidly increasing the number of global network outages, and the methods and types of attacks vary widely. Is getting.

The most important issue facing large enterprises and service providers today is the security risks that result from paralyzing these hacker attacks and compromising the stability and integrity of the data stored on them.

In order to solve such security risks, the introduction of firewalls and intrusion detection systems (IDS) is increasing.

However, unlike general hacking, distributed denial of service (DDoS) attacks, including denial of service (DoS) attacks, aim not only to disrupt the system but also to block services through the network's seizure of resources.

Therefore, there is a problem in that an isolated solution such as a firewall or an intrusion detection system cannot solve a denial of service attack or a distributed denial of service attack.

In addition, it is not easy to detect a denial of service attack or a distributed denial of service attack, and even if such an attack is detected, there is a problem such that the corresponding source is not properly blocked.

The present invention has been made to solve the above problems, and to provide a distributed service denial attack response system and method for detecting a distributed service denial attack and control the network connection device and a recording medium storing the program.

It is another object of the present invention to prevent distributed service denial attacks in the intermediate backbone and to prevent system destruction and network resource loss and to ensure the safe operation of the system. To provide a recording medium.

1 is a block diagram showing an embodiment of a distributed service denial attack response system according to the present invention.

2 is a state diagram for network traffic.

Figure 3 is a flow diagram illustrating an embodiment of a distributed service denial attack response method according to the present invention.

<Description of the symbols for the main parts of the drawings>

10,20,30: Network connection device 100: Response server

110: detection means 112: collector

114: classification unit 116: inspection unit

118: analysis unit 120: countermeasures

200: Statistics DB

In one embodiment of the present invention to achieve the above object is a statistics DB for storing the traffic statistics; Traffic information is collected from one or more network connection devices connecting the network to determine whether it is abnormal, and whether the traffic determined to be abnormal is subjected to a distributed service denial attack. Provides a distributed service denial attack response system including a response server to apply the movement limit.

In addition, in the present invention, the network connection device solves the above problems as a distributed service denial attack response system, characterized in that the router.

Further, in the present invention, the corresponding server collects traffic information from the network connection device, and determines whether the traffic is abnormal by comparing the collected traffic with a preset reference ratio and the statistical value, and determines that the traffic is abnormal Detecting means for determining whether a distributed service denial attack is performed; And a countermeasure for applying the traffic movement limit to the corresponding network connection device determined to be subjected to the distributed service denial attack.

In addition, in the present invention, the detection means is a collection unit for collecting traffic information from the network connection device; A classification unit classifying the traffic information collected by the collection unit into flows for each protocol of inbound and outbound; And determining whether the traffic is abnormal by comparing the number of flows for each protocol classified by the classification unit with the reference ratio and the statistical value, and deriving the distributed service denial attack by the ratio of the destination address of the abnormal protocol flow to the total traffic. The above-mentioned problem is solved as a distributed service denial attack response system, characterized in that it comprises a check unit for determining whether or not to receive.

In addition, in the present invention, the classifying unit compares whether the input interface index and the output interface index included in the traffic information corresponds to a predetermined inbound combination and outbound combination, characterized in that classified into inbound flow and outbound flow, respectively The above-mentioned problem is solved as a distributed service denial attack response system.

In addition, in the present invention, the classification unit solves the above-mentioned problems as a distributed service denial attack response system, characterized in that the classification by the protocol of the inbound flow and the outbound flow using the protocol number included in the traffic information.

In addition, in the present invention, the inspection unit for each protocol is determined as an abnormality if the number of inbound protocol flows and the number of outbound protocol flows is more than the reference ratio is determined as abnormal as the distributed service denial attack response system Solve one task.

In addition, in the present invention, the inspection unit compares the number of flows classified for each protocol by the classification unit with the statistical value stored in the statistics DB and determines that it is abnormal when it is out of a predetermined confidence interval. The system solves the above problem.

In addition, in the present invention, the countermeasure unit transitions the abnormal state to a transient state if the inspection unit determines that the abnormal traffic is normal after a predetermined time, and the transient state traffic is again returned from the inspection unit after a predetermined time. If it is determined to be normal, the above-mentioned problem is solved as a distributed service denial attack countermeasure system, which transitions the transient state to a normal state and releases the traffic movement limit applied to the network connection device.

In addition, in the present invention, the countermeasure means, when the inspection unit determines that the transient traffic is abnormal again after a predetermined time, the transient service transition to the abnormal service, characterized in that for transition to the abnormal state described above Solve one task.

In addition, in the present invention, the detection means further comprises an analysis unit for updating the statistical value stored in the statistics DB by including the number of flows classified by protocol in the classification unit as described above as a distributed service denial attack response system Solve a task.

In order to achieve the above object, another embodiment of the present invention includes the steps of: (a) collecting traffic information from one or more network connection devices connecting the network; (b) determining whether the collected traffic is abnormal; (c) determining whether the traffic determined to be abnormal is subjected to a distributed service denial attack; And (d) applying a traffic movement restriction to the corresponding network connection device that is determined to be subjected to the distributed service denial attack.

In addition, in the present invention, step (b) comprises the steps of: (b1) classifying the collected traffic information into inbound and outbound protocol specific flows; And (b2) determining whether the traffic is abnormal by comparing the number of classified protocol flows with a preset reference ratio and pre-stored statistical values. Solve.

Also, in the present invention, step (b1) compares whether the input interface index and the output interface index included in the traffic information correspond to a predetermined inbound combination and outbound combination, respectively, as inbound flow and outbound flow. Classifying; And (b12) classifying the inbound flow and the outbound flow for each protocol using the protocol number included in the traffic information.

In addition, in the present invention, step (b2) may include (b21) determining an abnormality if the number of inbound protocol flows and the number of outbound protocol flows for each protocol differ by more than the reference ratio; And (b22) comparing the number of flows classified for each protocol with the statistical value to determine abnormality when it is out of a predetermined confidence interval.

In addition, in the present invention, the step (c) is a distributed service denial of service attack response method, characterized in that for determining whether the traffic is subjected to a distributed service denial attack at the ratio of the destination address of the abnormal protocol flow in the total traffic. Solve the problem.

In addition, in the present invention, step (d) comprises: (d1) transitioning the abnormal state to a transient state if it is determined that the abnormal traffic is normal after a predetermined time in step (c); And (d2) if the transient traffic is determined to be normal again after a predetermined time, transitioning the transient state to a normal state and releasing a restriction on the amount of traffic movement applied to the network connection device. The above-mentioned problem is solved as a countermeasure against a denial of service attack.

Further, in the present invention, the step (d1), if the transient traffic is determined to be abnormal again after a predetermined time, the transient service rejection attack countermeasure method, characterized in that for transition to the abnormal state; Solve the problem.

In addition, the present invention solves the above-mentioned problem as a countermeasure against distributed service denial attack, further comprising the step (e) of updating the statistical value by including the number of flows classified for each protocol.

Another embodiment of the present invention to achieve the above object is (a) a process of collecting traffic information from one or more network connection devices connecting the network; (b) determining whether the collected traffic is abnormal; (c) determining whether the traffic determined to be abnormal is subjected to a distributed service denial attack; And (d) a recording medium recording a distributed service denial attack response program including a process of applying and managing a traffic movement limit to a corresponding network connection device determined to be subjected to a distributed service denial attack.

In addition, in the present invention, the process (b) includes (b1) a process of classifying the collected traffic information into inbound and outbound protocol-specific flows; And (b2) a process for determining whether the traffic is abnormal by comparing the number of classified flows for each protocol with a preset reference ratio and pre-stored statistical values.

Also, in the present invention, the process (b1) compares (b11) whether the input interface index and the output interface index included in the traffic information correspond to a predetermined inbound combination and outbound combination, respectively, as inbound flow and outbound flow. Classification process; And (b12) classifying the inbound flow and the outbound flow for each protocol using the protocol number included in the traffic information.

In addition, in the present invention, the process (b2) includes: (b21) a process of determining that the number of inbound protocol flows and the outbound protocol flows for each protocol is abnormal when the difference is greater than or equal to the reference ratio; And (b22) comparing the number of flows classified for each protocol with the statistical value, and determining the abnormality when the interval is out of a predetermined confidence interval.

In addition, in the present invention, the process (c) solves the above-described problem as a recording medium, characterized in that the traffic is subject to a distributed denial of service attack by the ratio of the destination address of the abnormal protocol flow to the total traffic.

In addition, in the present invention, the process (d) comprises: (d1) a process of transitioning the abnormal state to a transient state if it is determined that the abnormal traffic is normal after a predetermined time in the process (c); And (d2) if the transient traffic is determined to be normal again after a predetermined time, transitioning the transient state to a normal state, and releasing a restriction on the amount of traffic movement applied to the corresponding network connection device. The above problem is solved as a medium.

In addition, in the present invention, the process (d1) solves the above-described problems as the recording medium, wherein if the transient traffic is determined to be abnormal again after a predetermined time, the transient state transitions to an abnormal state. .

In addition, the present invention solves the above-described problem as a recording medium, further comprising the step (e) of updating the statistical value by including the number of flows classified for each protocol.

The objects, features and advantages of the present invention will be more readily understood by reference to the accompanying drawings and the following detailed description.

The present invention proposes a method for controlling a network connection device by detecting a distributed service denial attack and a system implemented to support the same as a preferred embodiment.

Preferred embodiments of the invention include embodiments such as computer systems and computer program products programmed to carry out the methods of the invention. According to an embodiment of a computer system, a set of instructions for carrying out a method resides in one or more memories, which may be stored as a computer program product on a recording medium such as a CD-ROM or the like.

1 is a block diagram showing an embodiment of a distributed service denial attack response system according to the present invention. Referring to FIG. 1, the distributed denial of service attack response system according to the present invention includes a corresponding server 100 for detecting and managing a distributed denial of service attack and a statistics DB 200 storing traffic statistics.

Distributed service denial attacks take a method of depleting a network or system resource with a large amount of traffic. Therefore, macro traffic monitoring of the entire network is required to detect distributed service denial attacks.

Typically, one or more network connections are responsible for traffic coordination for each network. It is preferable that the network connection device can provide traffic information flowing into or out of one network to the corresponding server 100, and the traffic information provided at this time is referred to as a netflow.

Therefore, the corresponding server 100 receives the netflow information from the network connection device, observes the behavior of the network traffic, and if it detects abnormal traffic, appropriately controls the network connection device.

To this end, the corresponding server 100 collects traffic information from one or more network connection devices 10 to 30 connecting the network. In this embodiment, the network connection devices 10 to 30 are preferably routers.

When the traffic is determined to be abnormal by determining whether the collected traffic is abnormal, the response server 100 determines whether the abnormal traffic is subjected to a distributed service denial attack. Therefore, if it is determined that the distributed service denial of attack, the traffic movement limit is applied to the network connection device (for example, 10).

The correspondence server 100 includes a detection means 110 and a correspondence means 120.

The detection unit 110 collects traffic information from the network connection devices 10 to 30, and compares the collected traffic with a preset reference ratio and statistical value to determine whether the traffic is abnormal. If it is determined that the traffic is abnormal, it is determined whether a distributed service denial attack is made.

The countermeasure unit 120 manages by applying a traffic movement limit to the network connection device 10 determined to be subjected to the distributed service denial attack.

The detection means 110 and the corresponding means 120 will be described in more detail as follows.

The detection unit 110 may include a collection unit 112, a classification unit 114, and an inspection unit 116, and may further include an analysis unit 118 as shown in FIG. 1.

The collecting unit 112 collects traffic information periodically (for example, every 5 minutes) from the network connection devices 10 to 30, and the traffic information is configured as shown in Table 1 below.

source IP address destination IP address next hop IP address input interface index output interface index packets bytes start time of flow end time of flow source port destination port pad TCP flags IP protocol TOS source AS destination AS src netmask length dst netmask length

Netflow uses a source IP address, a destination IP address, a protocol number (IP protocol), a source port number (source port), and a destination port number as a key. It consists of unit information.

The classifier 114 classifies the traffic information collected by the collector 112 into inbound and outbound protocol specific flows.

The process of classifying traffic information into inbound and outbound is as follows.

Assume that the set of input interface index values is A, and the set of output interface index values is B. The classification unit 114 has a predefined inbound flow combination {A, B} and an outbound flow {B, A} combination.

Accordingly, when the classification unit 114 determines which combination of the input interface index value and the output interface index value of the traffic information collected by the collection unit 112 corresponds to, the classification unit 114 may classify the traffic information into inbound and outbound flows. .

Then, classification is performed for each inbound flow and outbound flow protocol by using a protocol number (IP protocol) included in the traffic information.

For example, assuming that there are three protocols: TCP, UDP, and ICMP, the classification unit 114 may determine inbound TCP flow, inbound UDP flow, inbound ICMP flow, outbound TCP flow, outbound UDP flow, and outbound ICMP flow. Classify as

The inspection unit 116 compares the flow for each protocol classified by the classification unit 114 with a preset reference ratio and statistical values stored in the statistics DB 200 to determine whether the traffic is abnormal.

First, for each protocol, it is determined whether the number of inbound protocols and the number of outbound protocol flows differ by more than a reference ratio. If the number of inbound flows and the number of outbound flows differ by more than a reference ratio for the same protocol, it is determined as abnormal traffic, otherwise it is determined as normal traffic.

For example, in normal state, the number of inbound and outbound TCP flows remains similar. However, we found that there are more than 8 times the number of flows in case of distributed service attack. Therefore, if it is determined whether the number of inbound TCP flows and the number of outbound TCP flows differ by more than 8 times, it may be determined whether an abnormality occurs. In the case of UDP and ICMP, it is determined whether the difference is more than 8 times as in TCP.

Then, the classification unit 114 compares the number of flows classified for each protocol with statistical values previously stored in the statistics DB 200 to determine whether the traffic is abnormal. That is, when the number of flows classified for each protocol in the classification unit 114 is out of a predetermined confidence interval (for example, 95%) by comparing with a statistical value stored in the statistics DB 200, it is determined as abnormal traffic.

If it is determined to be abnormal by any one of the above two criteria, it is determined whether the traffic is attacked by the distributed service denial by the ratio of the destination address of the abnormal protocol flow to the total traffic.

To this end, the inspection unit 116 obtains a destination address of a protocol flow classified as abnormal, and checks whether the obtained destination address occupies more than a reference ratio of all traffic.

For example, if the top 10 of the destination addresses of the protocol flows classified as abnormal are obtained, and any one of the top 10 accounts for more than 90% of the traffic, the traffic is determined to receive a distributed denial of service attack.

The countermeasure unit 120 manages by applying a traffic movement limit to the corresponding network connection device (eg, 10) determined by the inspection unit 116 to be subjected to the distributed service denial attack. This imposes a traffic traffic limit on the network connection in order to allocate a certain amount of bandwidth to any host based on the destination address.

Although FIG. 1 illustrates the case where the traffic movement limit is applied to one network connection device 10 for convenience of explanation, the countermeasure 120 has a traffic movement amount to all network connection devices classified as being subjected to a distributed service denial attack. Manage by applying restrictions.

The countermeasure unit 120 preferably uses the destination address obtained by the inspection unit 116 to prepare an access list for the network connection device.

2 is a state diagram for network traffic.

The steady state is a state in which traffic has a normal flow, and a traffic movement limit is not applied. An abnormal state is a state in which traffic has an abnormal flow, and a traffic movement limit is applied.

The transient state is an intermediate state for transitioning from an abnormal state to a normal state.

If abnormal traffic is determined to be normal by the inspection unit 116 after a predetermined time, the countermeasure unit 120 transitions the abnormal state to the transient state as shown in FIG. This is to check whether the transition to the normal state may be performed, and the countermeasure unit 120 maintains the traffic movement amount limit applied in the abnormal state.

And, if it is determined that the transient traffic is normal again by the inspection unit 116 after a predetermined time, the countermeasure unit 120 transitions the transient state to the normal state, and releases the restriction on the traffic movement amount applied to the network connection device.

If the transient traffic is determined to be abnormal by the inspection unit 116 after a predetermined time, the countermeasure unit 120 transitions the transient to an abnormal state.

On the other hand, the analysis unit 118 updates the statistical values stored in the statistics DB 200 by including the number of flows classified for each protocol in the classification unit 114.

3 is a flowchart illustrating an embodiment of a method for responding to a distributed service denial attack according to the present invention.

Referring to FIG. 3, the present invention collects traffic information from one or more network connection devices connecting the network (S300), determining whether the collected traffic is abnormal (S310 to S330), and determines abnormal. Determining whether the traffic is subjected to a distributed service denial attack (S340), and applying a traffic movement limit to the network connection device determined to be subjected to a distributed service denial attack (S350).

The present invention may further include updating the statistical value by including the number of flows classified for each protocol (S360).

In step S310, the input interface index and the output interface index included in the traffic information are classified into inbound flows and outbound flows, respectively, by comparing whether they correspond to a predetermined inbound combination and outbound combination.

In step S320, the protocol number included in the traffic information is used to classify the protocols of the inbound flow and the outbound flow.

In step S330, if there is a difference between the number of inbound protocol flows and the number of outbound protocol flows for each protocol by more than a reference ratio, it is determined to be abnormal. In addition, by comparing the number of flows classified for each protocol with a statistical value, it is determined to be abnormal when it is out of a predetermined confidence interval.

In step S340, the traffic is denied a distributed service denial attack at a ratio of the destination address of the abnormal protocol flow in the total traffic.

In step S350, when the abnormal traffic is determined to be normal after a predetermined time, the abnormal state transitions to the transient state. If the transient traffic is determined to be normal again after a predetermined time, the transient state is shifted to the normal state, and the traffic movement amount applied to the network connection device is released.

If the transient traffic is determined to be abnormal again after a predetermined time, the transient state transitions to an abnormal state.

In the present invention configured as described above, a process of detecting a distributed service denial attack attack by controlling a network connection device by detecting a distributed service denial attack will be described in detail with reference to FIGS. 1 to 3.

Collector 112 periodically collects the traffic information from the network connection device (10 ~ 30) (S300), the classification unit 114 for each protocol of the inbound and outbound traffic information collected by the collection unit 112 Classify as a flow.

The classification unit 114 compares whether the input interface index and the output interface index included in the traffic information correspond to a predetermined inbound combination and outbound combination, and classifies the collected traffic information into inbound flow and outbound flow, respectively (S310). ).

Then, using the protocol number included in the traffic information, classify once again for each protocol of the inbound flow and the outbound flow (S320).

The inspection unit 116 determines whether the traffic is abnormal by comparing the protocol-specific flows classified by the classification unit 114 with a preset reference ratio and statistical values stored in the statistics DB 200 (S330).

First, for each protocol, it is determined whether the number of inbound protocol flows and the number of outbound protocol flows differ by more than a reference ratio.

When the number of inbound flows and the number of outbound flows differ by more than a reference ratio for the same protocol, it is determined as abnormal traffic, otherwise it is determined as normal traffic.

Then, the classification unit 114 compares the number of flows classified for each protocol with statistical values previously stored in the statistics DB 200 to determine whether the traffic is abnormal. When the number of flows classified by protocol is out of a predetermined confidence interval (for example, 95%) by comparing with a statistical value stored in the statistics DB 200, it is determined as abnormal traffic.

If it is determined as abnormal by any one of the above two criteria, the inspection unit 116 determines whether the traffic is subjected to the distributed service denial attack at a ratio of the destination address of the abnormal protocol flow in the total traffic (S340).

The countermeasure unit 120 manages by applying a traffic movement limit to the corresponding network connection device (eg, 10) determined by the inspection unit 116 to be subjected to the distributed service denial attack (S350).

If abnormal traffic is determined to be normal by the inspection unit 116 after a predetermined time, the countermeasure unit 120 transitions the abnormal state to a transient state.

Then, if the transient traffic is determined to be normal again by the inspection unit 116 after a predetermined time, the countermeasure unit 120 transitions the transient state to the normal state, and limits the amount of traffic movement applied to the corresponding network connection device 10. Release it.

If the transient traffic is confirmed to be abnormal again by the inspection unit 116 after a predetermined time, the countermeasure unit 120 transitions the transient state to an abnormal state.

On the other hand, the analysis unit 118 updates the statistical value stored in the statistics DB 200 by including the number of flows classified for each protocol in the classification unit 114 (S360).

The present invention is not limited to the embodiments described above, and various modifications and changes can be made by those skilled in the art, which are included in the spirit and scope of the present invention as defined in the appended claims.

As described above, the present invention may analyze a netflow flowing into or out of a network connection device to detect a distributed service denial attack and control abnormal traffic.

In addition, the distributed service denial attack can be fundamentally blocked from the intermediate backbone to cope with system destruction and network resource loss, and ensure the safe operation of the system.

In addition, since the network can be prevented from a distributed service denial attack, various hacking can be prevented through security for each unit network.

Claims (27)

A statistics DB for storing traffic statistics; Traffic information is collected from one or more network connection devices connecting the network to determine whether it is abnormal, and whether the traffic determined to be abnormal is subjected to a distributed service denial attack. Distributed service denial attack response system including a response server to apply the movement limit. The distributed service denial attack response system according to claim 1, wherein the network connection device is a router. The method of claim 1 or 2, wherein the corresponding server Collects traffic information from the network connection device, compares the collected traffic with a preset reference ratio and the statistical value, and determines whether the traffic is abnormal, and if the traffic is abnormal, detects whether a distributed service denial attack is received. Way; And Distributed service denial attack response system comprising a countermeasure for applying the traffic movement limit to the network connection device determined to be subjected to a distributed service denial attack. The method of claim 3, wherein the detecting means Collecting unit for collecting traffic information from the network connection device; A classification unit classifying the traffic information collected by the collection unit into flows for each protocol of inbound and outbound; And By comparing the number of flows for each protocol classified by the classification unit with the reference ratio and the statistical value, it is determined whether the traffic is abnormal or not, and the traffic is subjected to the distributed service denial attack in the ratio of the destination address of the abnormal protocol flow to the total traffic. Distributed service rejection attack response system, characterized in that it comprises a check unit for determining whether to receive. The method of claim 4, wherein the classification unit And comparing the input interface index and the output interface index included in the traffic information to a predetermined inbound combination and outbound combination, and classifying them into inbound flow and outbound flow, respectively. The method of claim 5, wherein the classification unit Distributed service denial attack response system, characterized in that the classification by the protocol of the inbound flow and the outbound flow using the protocol number included in the traffic information. The method of claim 4, wherein the inspection unit Distributed service denial attack response system for each protocol characterized in that it is determined that the number of inbound protocol flows and the number of outbound protocol flows is more than the reference ratio. The method of claim 4, wherein the inspection unit The classification unit compares the number of flows classified for each protocol with the statistical values stored in the statistics DB, and determines abnormality when it is out of a predetermined confidence interval. The method of claim 4, wherein the corresponding means After the predetermined time, if the abnormal traffic is determined to be normal by the inspection unit, the abnormal state is transitioned to a transient state, and after the predetermined time, when the transient traffic is determined to be normal again, the transient state is normal. A system for countering a denial of service attack, comprising: transitioning to a network; The method of claim 9, wherein the corresponding means If the inspection unit determines that the transient traffic is abnormal again after a predetermined time, the distributed service rejection attack response system, characterized in that for transition to the abnormal state. The method of claim 4, wherein the detection means The classification unit further includes an analysis unit including the number of flows classified for each protocol to update the statistical value stored in the statistics DB. (a) collecting traffic information from one or more network connection devices connecting the network; (b) determining whether the collected traffic is abnormal; (c) determining whether the traffic determined to be abnormal is subjected to a distributed service denial attack; And (d) Distributed service denial of service attack response method comprising the step of applying the traffic traffic restrictions to the network connection device determined to be subjected to a distributed service denial of attack. The method of claim 12, wherein step (b) (b1) classifying the collected traffic information into inbound and outbound protocol specific flows; And (b2) comparing the classified number of flows for each protocol with a preset reference ratio and a pre-stored statistical value to determine whether the traffic is abnormal. The method of claim 13, wherein step (b1) (b11) classifying the input interface index and the output interface index included in the traffic information into inbound and outbound flows, respectively, by comparing whether they correspond to a predetermined inbound and outbound combination; And and (b12) classifying each protocol according to the inbound flow and the outbound flow by using the protocol number included in the traffic information. The method of claim 13, wherein step (b2) (b21) determining an abnormality if the number of inbound protocol flows and the number of outbound protocol flows for each protocol differ by more than the reference ratio; And and (b22) comparing the number of flows classified for each protocol with the statistical value and determining abnormality when it is out of a predetermined confidence interval. The method of claim 12, wherein step (c) Distributed service denial attack response method characterized in that it determines whether the traffic is subjected to a distributed service denial attack in the ratio of the destination address of the abnormal protocol flow in the total traffic. The method of claim 12, wherein step (d) (d1) transitioning the abnormal state to a transient state if it is determined that the abnormal traffic is normal after a predetermined time in step (c); And (d2) if the transient traffic is determined to be normal again after a predetermined time, transitioning the transient state to a normal state and releasing a restriction on the amount of traffic movement applied to the network connection device. Countermeasures to Deny Attacks. The method of claim 17, wherein step (d1) If the transient traffic is determined to be abnormal again after a predetermined time, the distributed service rejection attack response method, characterized in that for transition to the abnormal state. The method according to any one of claims 12 to 18, And (e) updating the statistical value by including the number of flows classified for each protocol. (a) a process of collecting traffic information from one or more network connection devices connecting the network; (b) determining whether the collected traffic is abnormal; (c) determining whether the traffic determined to be abnormal is subjected to a distributed service denial attack; And (d) a recording medium recording a distributed denial of service attack response program including a process of applying and managing traffic movement restriction to a corresponding network connection device determined to be subjected to a distributed denial of service attack. The process of claim 20, wherein (b) (b1) classifying the collected traffic information into inbound and outbound protocol specific flows; And and (b2) a process of determining whether the traffic is abnormal by comparing the number of classified flows for each protocol with a preset reference ratio and previously stored statistical values. The process of claim 21, wherein the process (b1) (b11) comparing the input interface index and the output interface index included in the traffic information with a predetermined inbound combination and an outbound combination to classify each into an inbound flow and an outbound flow; And and (b12) classifying the protocols of the inbound flow and the outbound flow by using the protocol number included in the traffic information. The process of claim 21, wherein (b2) (b21) determining that the number of inbound protocol flows and the number of outbound protocol flows are abnormal for each protocol when there is a difference of more than the reference ratio; And and (b22) comparing the number of flows classified by protocol with the statistical value and determining that the flow is abnormal when out of a predetermined confidence interval. The process of claim 20, wherein the process (c) And determining whether the traffic is subject to a distributed denial of service attack by the ratio of the destination address of the abnormal protocol flow to the total traffic. The process of claim 20, wherein the process (d) (d1) a process of transitioning the abnormal state to a transient state if it is determined that the abnormal traffic is normal after a predetermined time in the process (c); And and (d2) if the transient traffic is determined to be normal again after a predetermined time, transitioning the transient state to a normal state and releasing a restriction on the amount of traffic movement applied to the network connection device. . The process of claim 25, wherein the (d1) process is And if the transient traffic is determined to be abnormal again after a predetermined time, transitioning the transient state to an abnormal state. The method according to any one of claims 20 to 26, And (e) a process of updating the statistical value by including the number of flows classified for each protocol.