Dynamic Security Level Changing Strategy Using Attack Predictions - Case Study of TCP SYN Attacks

We can make a system more secure from some types of attacks if we increase the security level against the attacks on the system. However, the increased security brings about performance degradation on the system. Therefore, it will be efficient to maintain the security level in low or mid, and temporally increase it to high only when an attack is predicted on the system in a short time. In this paper, we present an attack prevention strategy for a server node by changing the security level dynamically according to the attack situation on its neighboring nodes. As a case study, we apply our strategy to a server node against TCP SYN flood attacks. Our performance analysis shows that our strategy can effectively mitigate the damage of the attack without serious performance degradation.