An efficient detection of TCP Syn flood attacks with spoofed IP addresses

Abstract

TCP SYN flood attack has been one of representative DDoS attack in computer security history. To cope with this, a number of researches have been done, but they have a high false detection rate and are hard to be applicable in network address translation environment which is very common in the real world. To address these problems, we propose an efficient scheme to cope with SYN flood attacks with spoofed IP addresses. Compared to the existing approaches, it achieves the lowest false positive rate of 0.0003% at maximum and detects false IP packets at an earlier point of time, which serve to reduce the impacts of DDoS attacks significantly.