Annulling SYN Flooding Attacks with Whitelist

SYN flooding is one of classical Denial of Service (DoS) attacks abusing the TCP 3-way handshake process. This attack causes a server not to accept additional connection requests by filling the server’s backlog queue with malicious connection requests (SYN packets). Although several methods [1, 2, 3, 4, 5] have been proposed to solve the SYN Flooding attack, they cannot guarantee reliable connection establishments to clients under extremely aggressive SYN flooding attacks. In this paper, we propose a WhiteList-based defense scheme that increases connection success ratio of legitimate connection requests under SYN flooding attacks. We implemented this scheme as a linux kernel module. Experimental results show that the proposed method ensures high connection success ratio for legitimate clients and effectively annuls bogus SYN flooding.

• Type: Conference
• Year: 2008
• Where: AINA
• Authors: Tae Hyung Kim, Young-Sik Choi, Jong Kim, Sung Je Hong
• Keywords: AINA 2008, Computer Networks, Connection Requests, Connection Success Ratio, SYN flooding Attacks