Abstract: A method for detecting abnormal traffic may include receiving messages, counting the messages by types thereof, storing resulting counts to an IP hash array, and storing traffic characteristics in the IP hash array, depending on information on the counts of the messages stored in the IP hash array, storing IP information of the messages in the first N ranks in terms of count to a sequencing array wherein N is a natural number, receiving new IP information, and updating the IP information of the messages in the first N ranks and storing the updated IP information to the sequencing array, and in the updated sequencing array, verifying occurrence of abnormal traffic associated with the messages of a specific said type against a preset corresponding characteristic value.

Abstract: Disclosed are a method and system for shunting reflective DDOS traffic. The method includes: acquiring and detecting data flow of a network node A to obtain an attack source IP address and a set of attack types (Set T) where the attack source IP address generates attack traffic of which the type belongs to the set of attack types (Set T); sending the attack source IP address and the set of attack types (Set T) to a drainage device; sending, by the drainage device, all requests for the set of attack types (Set T) to the attack source IP address; and draining attack traffic sent by the attack source IP address to a network node B where the attack traffic is cleaned. The attack source IP address is an IP address of a base server utilized by a hacker.

Abstract: A method for detecting abnormal traffic may include receiving messages, counting the messages by types thereof, storing resulting counts to an IP hash array, and storing traffic characteristics in the IP hash array, depending on information on the counts of the messages stored in the IP hash array, storing IP information of the messages in the first N ranks in terms of count to a sequencing array wherein N is a natural number, receiving new IP information, and updating the IP information of the messages in the first N ranks and storing the updated IP information to the sequencing array, and in the updated sequencing array, verifying occurrence of abnormal traffic associated with the messages of a specific said type against a preset corresponding characteristic value.