An improved algorithm for detecting SYN flooding attacks based on network processor

This paper presents an improved algorithm for detecting the SYN flooding attacks. The algorithm is based on the characteristics of the network processor IXP2850´s hardware and software framework. It improves the typical method that is based on checking the received SYN segments twice from the same source. The improved algorithm will label the segments first, and then verify them to determine whether an attack happens. By this algorithm, the false alarm rate will decrease and the valid defense measures will be done at the right moment.