Detecting SYN Flooding Attacks

8 years 11 months ago
Detecting SYN Flooding Attacks
Abstract—We propose a simple and robust mechanism for detecting SYN flooding attacks. Instead of monitoring the ongoing traffic at the front end (like firewall or proxy) or a victim server itself, we detect the SYN flooding attacks at leaf routers that connect end hosts to the Internet. The simplicity of our detection mechanism lies in its statelessness and low computation overhead, which make the detection mechanism itself immune to flooding attacks. Our detection mechanism is based on the protocol behavior of TCP SYN–FIN (RST) pairs, and is an instance of the Sequential Change Point Detection [1]. To make the detection mechanism insensitive to site and access pattern, a non-parametric Cumulative Sum (CUSUM) method [4] is applied, thus making the detection mechanism much more generally applicable and its deployment much easier. The efficacy of this detection mechanism is validated by trace-driven simulations. The evaluation results show that the detection mechanism has short...
Haining Wang, Danlu Zhang, Kang G. Shin
Added 15 Jul 2010
Updated 15 Jul 2010
Type Conference
Year 2002
Authors Haining Wang, Danlu Zhang, Kang G. Shin
Comments (0)