Detection of Syn Flooding Attacks using Linear Prediction Analysis

This paper presents a simple but fast and effective method to detect TCP SYN flooding attacks. Linear prediction analysis is proposed as a new paradigm for DoS attack detection. The proposed SYN flooding detection mechanism makes use of the exponential backoff property of TCP used during timeouts. By modeling the difference of SYN and SYN+ACK packets, we are successfully able to detect an attack within short delays. We use this method at leaf routers and firewalls to detect the attack without the need of maintaining any state