Abstract: A data billing system is provided. According to at least one embodiment of the present disclosure, a payload of an IP packet is stored whenever the IP packet is received. When a retransmitted packet retransmitted based on a TCP is received, an attack packet is detected by comparing the stored payload with a payload of the retransmitted packet. This prevents a malicious attack in which a misuser desires to use data transmitted over a mobile communication network free of charge by inserting an attack packet in the payload of the retransmitted packet.