Provided is an apparatus and method for detecting a traffic flooding attack and conducting an in-depth analysis using data mining that may rapidly detect a distributed denial of service (DDoS) attack, for example, a traffic flooding attack, developed more variously and firmly from a denial of service (DoS) attack, perform an attack type classification, and conduct a semantic analysis with respect to the attack. The apparatus and method may support a system operation and provide a more stable service, by rapidly detecting a traffic flooding attack, classifying a type of the attack, and conducting a semantic analysis based on a prediction and analysis scheme of data mining.