Active Detecting Method against SYN Flooding Attacks
Xiaobo Yang · 2010
SYN Flood brings great danger to the normal network operation.Many research studies detect the attack by analyzing the self-similarity of network traffic.However,the method may be ineffective to SYN Flood.By analyzing the high-precision traces which are captured by DAG cards,we proposed a new SYN Flood detection mechanism based on the active detection.It brings the technology of packet-pair to abnormal traffic detection that detects SYN Flood,accor-ding to the background flow length change.The method has a 88% SYN attack detection rate from experimental results.This method is based on end-to-end technology which has better flexibility and controllability.