An Early Stage Detecting Method against SYN Flooding Attack

Distributed denial-of-service (DDoS) attacks pose a serious threat to Internet security. While SYN flooding exploits the TCP three-way handshake process by sending many connection requests using spoofed source IP addresses to a victim server. DDoS attack keeps objective host from handling legitimate requests by causing it to populate its backlog queue with forged TCP connection. In this paper, we propose a novel defense mechanism that makes use of the edge routers that connect end hosts to the Internet to store and detect whether the outgoing SYN, ACK or incoming SYN/ACK segment is valid. This is accomplished by maintaining a mapping table of the outgoing SYN segments and incoming SYN/ACK segments and establishing the destination and source IP address database. The results of simulation show the approach can yield accurate DDoS alarms at early stage.