Detection Method Against DDoS Attacks Based on Linear Prediction
Huang Yi-ran · Jisuanji gongcheng · 2008
Distributed Denia1 of Service(DDoS) attack is a major threat to Internet services.TCP SYN flooding is one of the most common methods used in DoS attacks.This paper presents a fast and effective method to detect TCP SYN flooding attacks.Linear prediction analysis is proposed as a new paradigm for DoS attack detection.The proposed SYN flooding detection mechanism makes use of the exponential backoff property of TCP used during timeouts.By modeling the difference of SYN and SYN+ACK packets,an attack is detected successfully within short delays.The method is used to leaf routers and firewalls to detect the attack without the need of maintaining any state.