Apparatus and method for protecting ddos

PURPOSE: A distributed service denying protecting device and method thereof are provided to reinforcing security of a network and a server system by helping a performance of a abnormal packet detecting function. CONSTITUTION: A session table(232) stores session information for coping with an invasion detection. A flow table(231) stores traffic measurement information by flow. A packet extracting unit(210) extracts packet from an inflow traffic. A detecting unit(220) extracts a field for a session tracking and traffic measurement from the packet. The detecting unit detects an abnormal packet through one between extracted field and the session table. A corresponding unit(240) secludes the abnormal packet.