On Modeling Counteraction against TCP SYN Flooding
Information Networking. Towards Ubiquitous Networking and Services
Characterising Anomalous Events Using Change - Point Correlation on Unsolicited Network Traffic
NordSec '09 Proceedings of the 14th Nordic Conference on Secure IT Systems: Identity and Privacy in the Internet Age
A more accurate scheme to detect SYN flood attacks
INFOCOM'09 Proceedings of the 28th IEEE international conference on Computer Communications Workshops
Traceback-based Bloomfilter IPS in defending SYN flooding attack
WiCOM'09 Proceedings of the 5th International Conference on Wireless communications, networking and mobile computing
Flow level detection and filtering of low-rate DDoS
Computer Networks: The International Journal of Computer and Telecommunications Networking
| Hi-index | 0.00 |
TCP-based flooding attacks are a common form of Distributed Denial-of-Service (DDoS) attacks which abuse network resources and can bring about serious threats to the Internet. Incorporating IP spoofing makes it even more di..cult to defend against such attacks. Among di..erent IP spoofing techniques, which include random spoofing, subnet spoofing and fixed spoofing, subnet spoofing is the most di..cult type to fight against. In this paper, we propose a simple and e..cient method to detect and defend against TCP SYN flooding attacks under di..erent IP spoofing types, including subnet spoofing. The method makes use of a storage-e..cient data structure and a change-point detection method to distinguish complete three-way TCP handshakes from incomplete ones. Simulation experiments consistently show that our method is both efficient and e..ective in defending against TCP-based flooding attacks under di..erent IP spoofing types.