System and method for controlling abnormal traffic based on fuzzy logic

1. A system for controlling abnormal traffic based on a fuzzy logic, the system comprising:

a computer comprising

an intrusion detection module to analyze packets incoming from a network interface by a plurality of membership functions, wherein each membership function measures an amount of incoming packets during a period of time, the period of time for each membership function being a different length, and outputting fuzzy values representing a degree of a slow port scan attack;

a fuzzy control module to recognize the degree of the slow port scan attack based on the fuzzy values and output a control signal for traffic control according to the recognized degree of the slow port scan attack; and

an intrusion blocking module to control traffic with the network interface according to the control signal.

2. The system as claimed in claim 1 , wherein the intrusion detection module applies the membership functions based on a hierarchical structure according to the different lengths of time, and outputs a plurality of fuzzy values yielded from the membership functions.

3. The system as claimed in claim 2 , wherein the plurality of membership functions measure an amount of packets incoming from the network interface during each period of time, and yield the fuzzy values defining the degree of a slow port scan attack corresponding to the measured amount of the packets.

4. The system as claimed in claim 3 , wherein the fuzzy control module calculates a weight for the degree of a slow port scan attack by combining a plurality of fuzzy values output from the intrusion detection module, and outputs the control signal for the traffic control according to the calculated weight.

5. The system as claimed in claim 4 , wherein the intrusion blocking module adjusts a bandwidth according to the control signal, in order to block or reduce traffic with the network interface.

6. A method for controlling abnormal traffic based on a fuzzy logic, the method comprising:

receiving packets incoming from a network interface;

analyzing the received packets through a plurality of membership functions, wherein each membership function measures an amount of incoming packets during period of time, the period of time for each membership function being a different length, and yielding fuzzy values representing a degree of a slow port scan attack;

recognizing the degree of the slow port scan attack based on the yielded fuzzy values, and outputting a control signal for traffic control according to the degree of the slow port scan attack; and

controlling traffic with the network interface according to the control signal.

7. The method as claimed in claim 6 , wherein the membership functions are defined based on a hierarchical structure according to the different lengths of time, and a plurality of fuzzy values yielded from each of the membership functions are output.

8. The method as claimed in claim 7 , wherein analyzing the received packets comprises:

measuring an amount of packets incoming from the network interface during each period of time; and

yielding and outputting the plurality of fuzzy values defining the degree of the slow port scan attack corresponding to the measured amount of the incoming packet.

9. The method as claimed in claim 7 , wherein recognizing the degree of the slow port scan attack comprises:

calculating a weight for the degree of the slow port scan attack by combining the plurality of fuzzy values; and

outputting the control signal for traffic control according to the calculated weight.

10. The method as claimed in claim 6 , wherein the traffic with the network interface is blocked or reduced by adjusting a bandwidth according to the control signal.