Apparatus for detecting distributed denial of service attack and method for thereof

PURPOSE: An apparatus for detecting distribution service denial attacks and a method thereof are provided to detect the distribution service denial attacks by detecting packets after detecting symptoms of the distribution service denial attacks through packets. CONSTITUTION: A database management unit(110) stores distribution data about a usage port according to a group which is not uses P2P service and a group using P2P service in database. A first attack detecting unit(120) detects symptoms of distribution service denial attacks through a packet having an attack port with the stored distribution data. A second attack detecting unit(130) detects the distribution service denial attacks by detecting the packets.