TCP - IP White Papers
Detecting Distributed Denial-of-Service Attacks by Analyzing TCP SYN Packets Statistically
Overview Distributed denial-of-service attacks on public servers have recently become more serious. More are SYN Flood attacks, since the malicious attackers can easily exploit the TCP specification to generate traffic making public servers unavailable. To assure that network services will not be interrupted, the author needs faster and more accurate defense mechanisms against malicious traffic, especially SYN floods. One of the problems in detecting SYN Flood traffic is that server nodes or firewalls cannot distinguish the SYN packets of normal TCP connections from those of SYN Flood attack. Moreover, since the rate of normal network traffic may vary, one cannot use an explicit threshold of SYN arrival rates to detect SYN Flood traffic.
| Publisher | Osaka University | File Format | |
|---|---|---|---|
| Date Published | November 2004 | Downloads | 1 |
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 2 out of 4 users found this white paper useful
White Paper RSS
Download
Register
