A Probabilistic Drop Scheme for Mitigating SYN Flooding Attacks

SYN flooding has been a serious security threat to Internet. For a host server, it is necessary to take some kind of admission control in defense against SYN flooding attacks. In this paper, a probabilistic drop scheme is presented for implementation in a host server to mitigate SYN flooding attacks. An analytical model is proposed for this scheme, and a general principle for evaluating the probability of successful connection establishment during a SYN flooding attack is presented. Performance analysis results show (i) retransmission behavior of an application has positive influence on the successful establishment of its connection requests; (ii) a higher probability of connection establishment can be obtained by the probabilistic drop scheme than that by the random drop scheme when a SYN flooding attack occurs.