Abstract: Method and apparatus for blocking a distributed denial-of-service (DDoS) attack are provided. It is first determined whether a traffic status of an origin server is based on the DDoS attack. When it is determined that the traffic status of the origin server is based on the DDoS attack, a DNS is requested to change an Internet protocol (IP) address of the origin server to the IP address of at least one of plural servers. Accordingly, it is possible to accept a normal service providing request and also to determined and block the DDoS attack. In addition, since a device for determining and blocking the DDoS attack need not be installed in each site or server, it is possible to efficiently determine and block the DDoS attack at reduced cost.

Abstract: The step of setting policy set tables includes the steps of generating one or more first-order policy set tables corresponding to one or more sections of packet information, respectively, each of said first-order policy set tables containing at least one policy sets having a predetermined number of policy members to be related with the corresponding section of the packet information; and pairing off said plurality of policy set tables to generate next-order policy set tables with all possible intersections of the paired first-order policy set tables. The step of discriminating the policy includes the steps of extracting one or more sections of packet information related to the policy information from the incoming packet; and querying to each of all the generated policy set tables with respective index values corresponding to each of the extracted packet information sections to discriminate the final policy for the incoming packet.

Abstract: The step of setting policy set tables includes the steps of generating one or more first-order policy set tables corresponding to one or more sections of packet information, respectively, each of said first-order policy set tables containing at least one policy sets having a predetermined number of policy members to be related with the corresponding section of the packet information; and pairing off said plurality of policy set tables to generate next-order policy set tables with all possible intersections of the paired first-order policy set tables. The step of discriminating the policy includes the steps of extracting one or more sections of packet information related to the policy information from the incoming packet; and querying to each of all the generated policy set tables with respective index values corresponding to each of the extracted packet information sections to discriminate the final policy for the incoming packet.