Detecting SYN Flooding Attacks

Abstract — We propose a simple and robust mechanism for de-tecting SYN flooding attacks. Instead of monitoring the ongoing traffic at the front end (like firewall or proxy) or a victim server itself, we detect the SYN flooding attacks at leaf routers that con-nect end hosts to the Internet. The simplicity of our detection mechanism lies in its statelessness and low computation overhead, which make the detection mechanism itself immune to flooding at-tacks. Our detection mechanism is based on the protocol behavior of TCP SYN–FIN (RST) pairs, and is an instance of the Sequen-tial Change Point Detection [1]. To make the detection mecha-nism insensitive to site and access pattern, a non-parametric Cu-mulative Sum (CUSUM) method [4] is applied, thus making the detection mechanism much more generally applicable and its de-ployment much easier. The efficacy of this detection mechanism is validated by trace-driven simulations. The evaluation results show that the detection mechanism has short detection latency and high detection accuracy. Moreover, due to its proximity to the flood-ing sources, our mechanism not only sets alarms upon detection of ongoing SYN flooding attacks, but also reveals the location of the flooding sources without resorting to expensive IP traceback. I