Detection of SYN Flooding Attacks Based on Non-parametric CUSUM Algorithm
Li Ou · Jisuanji gongcheng · 2006
This paper proposes a novel detection scheme against SYN Flooding attacks. The core detection mechanism of the system is based on the protocol behavior of TCP SYN-FIN(RST) pairs, and monitors the balance between SYN and FIN(RST) pairs of incoming TCP traffic and uses the non-parametric CUSUM algorithm to detect the change of the difference between the number of SYN and FIN(RST) packets. This algorithm doesn’t require a detailed model of normal and attack traffic. It can improve the detection accuracy and the rate of the on-line detection while reducing the computing overhead.