Counteracting TCP SYN DDoS attacks using automated model
Udaya Kiran Tupakula, Vijay Varadharajan, Ashok Kumar Gajam · 2005
We propose modifications to the automated model to counteract TCP SYN distributed denial of service (DDoS) attacks nearest to the attacking source and also discuss the prototype implementation of our technique. It should be noted that we do not solve the TCP SYN problem, but we enable the victim to differentiate between the traffic originating from good and bad network domains, trace the router that is nearest to the attacking source with a single packet, even if the source address of the packet is spoofed, and prevent the attack traffic at the router which is nearest to the attacking source. Since our model is invoked only during attack times, it has much less overhead, and the main advantage of this technique is that the victim can provide better service for traffic originating from good network domains and completely eliminate or provide limited service for the traffic originating from the bad network domain.