SYN Flooding Detecting Using Negative Selection Algorithm Based on Eigenvalue Sets

Eigenvalue matching was introduced based on analyzing the continuous bits matching rule. Using the new matching rule the negative selection algorithm was improved both in detector generation and "black hole" detection. A defense system against SYN Flooding attack with immune detection was put forward, and four sections detection with weight was proposed based on considering the uncontinuity of IP address. The detectors and theeigenvalue filter windoware applied to detect all of nonself modes. Simulation results show that the defense system could effectively detect the fake IP addresses from SYN flooding and insure the server could be accessed by legal users. Also, the consumption of the detection time is not increased significantly.