Abstract:The TCP SYN flooding attack is the most prevalent type of DDoS attacks that exhaust network resources. A router based detection scheme has been proposed to detect the SYN flooding agents based on the assumption that the SYN packets from the agent and the SYN/ACK packets from the victimpsilas server pass through different leaf routers. In the current IP spoofing techniques, however, the attacker can spoof a random address from any subnetwork, so the SYN packets from the agent and the SYN/ACK packets from the server may pass through the same leaf router. Therefore, a more general and flexible detection scheme is highly desirable for the efficient detection of these flooding agents under any type of IP spoofing. In this paper, we propose such a scheme to detect the flooding agents by considering all the possible kinds of IP spoofing. The proposed scheme is based on the TCP SYN-SYN/ACK protocol pair with the consideration of packet header information (both sequence and Ack. numbers). The Counting Bloom Filter is used to classify all the incoming SYN/ACK packets to the sub network into two streams, the first SYN/ACK packets (SYN/ACKf ) and the retransmission SYN/ACK packets (SYN/ACKr), to make our scheme generally applicable and the Cumulative Sum algorithm is applied to avoid the dependence of detection on sites and access patterns. Compared to the old detection scheme without the consideration of IP spoofing techniques, the proposed new scheme can significantly improve the accuracy in detecting the SYN flooding agents, as verified by extensive simulation results based on different IP spoofing techniques.

Sliding-mode Observers for Real-Time DDoS Detection

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

High-Order Terminal Sliding-Mode Observers for Anomaly Detection.

A novel mechanism to defend against low-rate denial-of-service attacks

Router based detection for low-rate agents of DDoS attack

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Comparative Studies Of Router-Based Observation Schemes For Anomaly Detection In Tcp/Udp Networks

Chattering-Free terminal sliding-mode observer for anomaly detection

Terminal Sliding Mode Observer For Anomaly Detection In Tcp/Ip Networksa

A Continuous Terminal Sliding-Mode Observer-Based Anomaly Detection Approach for Industrial Communication Networks

Reduced-order Observer-based Resilient Control for MASs with Time-varying Delay against DoS Attacks

A New Multistage Approach to Detect Subtle DDoS Attacks.

A new way to detect DDoS attacks within single router

Detecting SYN Flooding Agents under Any Type of IP Spoofing

An Adaptive Defending Mechanism Against Distributed Denial-of-Service (DDoS) Attacks

DDoS Attack Detection under SDN Context

An adaptive observer design for denial‐of‐service attack detection in platoon

Secure state estimation of networked switched systems under denial-of-service attacks

LDoS attack detection method based on traffic time-frequency characteristics

Detecting DDoS Attacks Based on Network Connection Statistics

Event-based Sliding Mode Control under Denial-of-service Attacks