SYN Flood Detection Method Based on Heavy-tail Property
XU Xiao-dong, Hailiang Yang · Jisuanji gongcheng · 2008
It is inefficient to judge whether SYN flood happens by using the ratio between SYN packets and total TCP packets.Normal network traffic has the characteristic of heavy-tailed,and it is hard for SYN flood attack to fabricate the same distribution as that of normal network traffic. This paper presents a method to detect it by combining the ratio between SYN packets and total TCP packets and heavy-tailed distribution of network traffic.Experiment with the dataset of MIT Lincoln Laboratory shows that the method can detect SYN flood attack quickly and has higher detection efficiency.