DDoS Attack Detection Algorithm Based on TCP Backlog
Guo Min-zhe · Jisuanji gongcheng · 2009
The Distributed Denial of Service(DDoS) attack developing from Denial of Service(DoS) attack has become one of the major threats to network security.This paper starts from the analysis of TCP backlog,and proposes an algorithm based on TCP Backlog detection.Algorithm analyzes TCP backlog combing with historical connected records,generates features vectors,detects abnormal level of TCP backlog using BP neural networks,determines whether attack happens according to the abnormal level.Experimental result shows that the algorithm can detect DDoS attack quickly and accurately,and prevent the occurrence of DDoS attack effectively.