Detection of DDoS Attacks Based on PCUSUM Algorithm
Zhilei Liu · Jisuanji fangzhen · 2009
The security system against SYN Flooding attacks requires a quick and accurate detection algorithm that can alert in best time when abnormity emerges.The core detection mechanism of the system is based on the protocol behavior of TCP SYN-FIN(RST) pairs,and employs PCUSUM algorithm to trace the difference normalized between them in real time and detects network flow abnormity.The algorithm doesn't need a detailed model of normal and attack traffic.Simulation experiments indicate that the algorithm has higher detecting speed and accuracy to SYN flooding attacks under the condition of the same veracity.