Detection of Syn Flooding Attacks using Linear Prediction Analysis

Author

Divakaran, Dinil Mon ; Murthy, Hema A. ; Gonsalves, Timothy A.

Author_Institution

Dept. of Comput. Sci. & Eng., Indian Inst. of Technol., Madras

Volume

1

fYear

2006

fDate

Sept. 2006

Firstpage

1

Lastpage

6

Abstract

This paper presents a simple but fast and effective method to detect TCP SYN flooding attacks. Linear prediction analysis is proposed as a new paradigm for DoS attack detection. The proposed SYN flooding detection mechanism makes use of the exponential backoff property of TCP used during timeouts. By modeling the difference of SYN and SYN+ACK packets, we are successfully able to detect an attack within short delays. We use this method at leaf routers and firewalls to detect the attack without the need of maintaining any state

Keywords

Internet; security of data; telecommunication security; transport protocols; DoS attack detection; TCP SYN flooding attack detection; exponential backoff property; firewalls; linear prediction analysis; routers; Computer crime; Computer science; Computer security; Delay; Fault detection; Floods; Large-scale systems; Mechanical factors; Traffic control; Web and internet services; DoS attack; Exponential Backoff; Linear prediction analysis; TCP SYN flooding;

fLanguage

English

Publisher

ieee

Conference_Titel

Networks, 2006. ICON '06. 14th IEEE International Conference on

Conference_Location

Singapore

ISSN

1556-6463

Print_ISBN

0-7803-9746-0

Type

conf

DOI

10.1109/ICON.2006.302563

Filename

4087690