By Topic

Detecting distributed denial-of-service attacks by analyzing TCP SYN packets statistically

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

3 Author(s)
Y. Ohsita ; Graduate Sch. of Inf. Sci. & Technol., Osaka Univ., Japan ; S. Ata ; M. Murata

Distributed denial-of-service attacks on public servers have recently become more serious. More are SYN flood attacks, since the malicious attackers can easily exploit the TCP specification to generate traffic making public servers unavailable. To assure that network services will not be interrupted, we need faster and more accurate defense mechanisms against malicious traffic, especially SYN floods. One of the problems in detecting SYN flood traffic is that server nodes or firewalls cannot distinguish the SYN packets of normal TCP connections from those of SYN flood attack. Moreover, since the rate of normal network traffic may vary, we cannot use an explicit threshold of SYN arrival rates to detect SYN flood traffic. In this paper we introduce a mechanism for detecting SYN flood traffic more accurately by taking into consideration the the time variation of arrival traffic. We first investigate the statistics of the arrival rates of both normal TCP SYN packets and SYN flood attack packets. We then describe our new detection mechanism based on the statistics of SYN arrival rates. Our analytical results show that the arrival rate of normal TCP SYN packets can be modeled by a normal distribution and that our proposed mechanism can detect SYN flood traffic quickly and accurately regardless of time variance of the traffic.

Published in:

Global Telecommunications Conference, 2004. GLOBECOM '04. IEEE  (Volume:4 )

Date of Conference:

29 Nov.-3 Dec. 2004