DDoS Detection System Based on Traffic Behavior
Yi Zhang, Qiang Liu · Jisuanji gongcheng · 2011
Because many traditional detection algorithms can not real time inspect the attack source and the victim,based on single-user traffic behavioral analysis,this paper presents a real-time DDoS flooding attack detection and prevention system.Based on the time synchronization of TCP and UDP protocol behavior,through periodically detecting every single IP user's sending and receiving traffic and judging whether its traffic behaviors meet the synchronization or not.This system can effectively recognize attackers,victims and normal users,and real time filter attackers' traffic and forward normal users' packets.Experimental results show that the system can make a real-time detection for DDoS flooding attacks and determine the attacker at the early attacking stage,and the defense effect is obvious.