Detecting distributed denial-of-service attack traffic by statistical test

This study has proposed a new detection method for DDoS attack traffic based on statistical test. We first investigate the statistics of SYN arrival rate and find that SYN arrival rate can be can be modeled by normal distribution. We set up a threshold for maximum arrival rate to detect DDoS flood traffic. We also establish a threshold for incomplete three-way handshaking packet ratio to detect possible DDoS traffic. The experiment results show that the possibilities of both false positives and false negatives are very low. The proposed mechanism is demonstrated to have the capability of detecting DDoS attack accurately.