A real-time method for detecting internet-wide SYN flooding attacks

摘要: Reports show that DDoS attacks are ubiquitous on the Internet and may jeopardize networks’ stable operation. In order to understand nature of this threat further enable effective control management, a whole picture Internet-wide is necessity. Traditional methods use darknets end. However, with IPv4 address space exhaustion, become hard acquire. paper, we seek detect using live network. particular, focus most prevalent SYN flooding attacks. First, complete attack scenario model introduced according positions attacker, victim attacking address. Then, after discussing features all scenarios, an algorithm named WSAND proposed Netflow data. evaluate it, deployed at 28 main PoPs (Points Presence) China Education Research Network (CERNET) total internal up 200/16 blocks. A large quantity detected in March 2014 discussed detail. With help attacks, case study detecting zombie presented.