Protecting web servers from distributed denial of service attacks
Proceedings of the 10th international conference on World Wide Web
An analysis of using reflectors for distributed denial-of-service attacks
ACM SIGCOMM Computer Communication Review
Hacking Exposed: Network Security Secrets and Solutions,Third Edition
Hacking Exposed: Network Security Secrets and Solutions,Third Edition
Improving the functionality of syn cookies
Proceedings of the IFIP TC6/TC11 Sixth Joint Working Conference on Communications and Multimedia Security: Advanced Communications and Multimedia Security
SYN-dog: Sniffing SYN Flooding Sources
ICDCS '02 Proceedings of the 22 nd International Conference on Distributed Computing Systems (ICDCS'02)
Analysis of a Denial of Service Attack on TCP
SP '97 Proceedings of the 1997 IEEE Symposium on Security and Privacy
Hop-count filtering: an effective defense against spoofed DDoS traffic
Proceedings of the 10th ACM conference on Computer and communications security
Resisting SYN flood DoS attacks with a SYN cache
BSDC'02 Proceedings of the BSD Conference 2002 on BSD Conference
Denial of service via algorithmic complexity attacks
SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
PSO-SFDD: Defense against SYN flooding DoS attacks by employing PSO algorithm
Computers & Mathematics with Applications
Detecting SYN flooding attacks based on traffic prediction
Security and Communication Networks
| Hi-index | 0.00 |
SYN flooding exploits the Transmission Control Protocol (TCP) three-way handshake process by sending many connection requests using spoofed source IP addresses to a victim's host. This keeps that host from handling legitimate requests, causing it to populate its backlog queue with forged TCP connections. In this article, we propose a novel defense mechanism that makes use of the edge routers that are associated with the spoofed IP addresses' networks to determine whether the incoming SYN-ACK segment is valid. This is accomplished by maintaining a matching table of the outgoing SYNs and incoming SYN-ACKs and also by using the ARP protocol. If an incoming SYN-ACK segment is not valid, the edge router resets the connection at the victim's host, freeing up an entry in the victim's backlog queue, and enabling it to accept other legitimate incoming connection requests. We also present a communication protocol to encourage collaboration between various networks to protect each other. We evaluated the performance of our proposed approach and studied its impact on the network. Our experimental and simulation results showed the efficiency of our proposed collaborative defense mechanism.