An efficient detection of TCP Syn flood attacks with spoofed IP addresses

Issue title: Special Section: Green and Human Information Technology

Guest editors: Seong Oun Hwang

Article type: Research Article

Authors: Bae, Youngjun^a | Kim, Intae^a | Hwang, Seong Oun^{b; *}

Affiliations: [a] Department of Electronics and Computer Engineering, Hongik University, Korea | [b] Department of Software and Communications Engineering, Hongik University, Korea

Correspondence: [*] Corresponding author. Seong Oun Hwang, Department of Software and Communications Engineering, Hongik University, Korea. E-mail: sohwang@hongik.ac.kr.

Abstract: TCP SYN flood attack has been one of representative DDoS attack in computer security history. To cope with this, a number of researches have been done, but they have a high false detection rate and are hard to be applicable in network address translation environment which is very common in the real world. To address these problems, we propose an efficient scheme to cope with SYN flood attacks with spoofed IP addresses. Compared to the existing approaches, it achieves the lowest false positive rate of 0.0003% at maximum and detects false IP packets at an earlier point of time, which serve to reduce the impacts of DDoS attacks significantly.

Keywords: SYN flood attack, DDoS attack, bloom filter

DOI: 10.3233/JIFS-169839

Journal: Journal of Intelligent & Fuzzy Systems, vol. 35, no. 6, pp. 5983-5991, 2018