An Improved Algorithm of Source-End Detection Mechanism Against DDoS Attack
LI Ken-li · Journal of Hunan University of Science and Engineering · 2007
From The basic principle of TCP protocol,based on TCP three handshake principles,put forward an algorithm which considers the amount different between SYN packets and the corresponding SYN/ACK packets as detection factor,in order to abbreviate the delay of detection,an improved CUSUM method is proposed by talking the number of attacker into account.The experimental results show:compare the D-WARD system,this algorithm generates lower false positive and rapider detection speed.