ARM-CPD: DETECTING SYN FLOODING ATTACK BY TRAFFIC PREDICTION

摘要：

This paper proposed an ARM-CPD scheme that is a simple but fast and effective approach to detect SYN flooding attacks. Instead of managing all real time ongoing traffic on the network, ARM-CPD only monitors the SYN packet and use it to predict the SYN packet in the near future to detect the SYN flooding attacks. To get the prediction SYN traffic, the Autoregressive Integrated Moving Average Model (ARIMA) is proposed; and to make the detection method insensitive to site and access pattern, a non-parametric Cumulative Sum (CUSUM) algorithm is applied. The trace-driven simulations demonstrate that ARM-CPD can shorten the detection time of SYN flooding attack effectively.

关键词： DoS TCP SYN flooding ARIMA CUSUM

作者: Sun Qibo Wang Shangguang Yan Danfeng Yang Fangchun

作者单位: State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China

会议类型: 国际会议

会议名称: 2009 2nd IEEE International Conference on Broadband Network & Multimedia Technology(2009年宽带网络与多媒体国际会议 IEEE IC-BNMT2009)

会议地点: 北京

会议语种:英文

页码: 443-447

在线出版日期: 2009-10-18（万方平台首次上网日期，不代表论文的发表时间）