Source Detection of SYN Flooding Attacks

We present an original approach to detect sources that participate in a SYN flooding attacks by monitoring unusual handshake sequences. To protect the victim, it is better to detect the attacker early and as closely to the source as possible. Such a solution prevents waste of resources by restricting harmful- and useless-traffic across the network. Our source detection system uses an entropy measure to detect changes in the balance of TCP handshakes. Experimental results show that our method can indeed detect the sources of SYN flooding attacks in timely fashion.