SYN flooding attack detection by TCP handshake anomalies

Abstract

We present an original approach to identify synchronize (SYN) flooding attacks from the victim's side, on the basis of a classification of the different forms that TCP handshakes can take during a connection set-up between a client and a server (e.g. for Web traffic). We first identify the unusual handshake sequences that result from an attack and show how such observations can be used for SYN flooding attack detection. We then introduce a data structure to monitor, in real time, the state of the TCP handshake and study its performance. In addition, we explain the management of the data structure for operations such as initialization, adding and removing flows. Finally, we analyse the effectiveness of our TCP handshake monitoring to identify the presence of SYN flooding attacks by applying it to real traffic traces. To allow quick protection and help guarantee a proper defence, the detection is done in real time. Our detection system uses a non-parametric cumulative sum algorithm (CUSUM), which has the benefit of not requiring a detailed model of the normal and attack traffic while achieving excellent detection levels.

TCP FIN Flood Attack Pattern Recognition on Internet of Things with Rule Based Signature Analysis

“…There are many research works on TCP SYN flood attacks such as [11], [12], [13], however very few research works on TCP FIN flood attacks. Yoon et al [14] discuss defense against general TCP Flooding Attack including the TCP FIN attacks.…”

Dynamic Dependability Level Switching Strategies by Utilizing Threat Predictions

“…Basically, we can detect TCP SYN flooding in a node by checking the number of current half-opened TCP connection. Even though, there are many enhanced ways presented to detect TCP SYN attacks [4,8], finding out the effective detection scheme is out of focus of this paper 3) . Although a compromised node by TCP SYN flooding cannot allow TCP connection requests from others, it can broadcasts TCP SYN flooding warning messages to the neighboring nodes using other communication methods.…”

Security novel risk assessment framework based on reversible metrics: a case study of DDoS attacks on an E‐commerce web server

“…We divide this range into four intervals assigned to each of the risk classes: low, medium, high, and critical. Once again, we chose decomposing into equivalent intervals: [0, 3] for low class, [4,7] for medium class, [8,11] for high class, and [12,14] is assigned to the critical class. In Table 4, we present two scenarios of risk classification: likelihood being more important than impact, and conversely.…”

“…A TCP SYN flood is an attack on the transport layer. In a network, connection sessions are initiated between a client and a server by exchanging special SYN–ACK segments.…”