Detecting SYN flooding attacks based on traffic prediction

摘要

SYN flooding attacks are a common type of distributed denial-of-service attacks. Up to now, many defense schemes have been proposed against SYN flooding attacks. Traditional defense schemes rely on passively sniffing an attacking signature and are inaccurate in the early stages of an attack. These schemes are effective only at the later stages when attacking signatures are obvious. In this paper, we propose a detection approach that makes use of SYN traffic prediction to determine whether SYN flooding attacks happen at the early stage. We firstly adopt grey prediction model to predict SYN traffic, and then, we employ cumulative sum algorithm to detect SYN flooding attack traffic among forecasted SYN traffic. Trace-driven simulation results demonstrate that our proposed detection approach can detect SYN flooding attacks effectively.