SYN flood attack detection in cloud environment based on TCP/IP header statistical features

Abstract

Virtualization is a foundational key to cloud computing that allows sharing single physical host, resources, and application among multiple users. Virtual cloud infrastructure is vulnerable to distributed denial of service attack, in particular, SYN flood attack which exhausts the server resources and makes it unavailable to the legitimate user. In the clouds, this type of attack impact can extend to a large number of resources which lead to doubling the losses. This paper discusses the SYN flood attack in virtual cloud and detects it based on new features that extracted from TCP/IP header. Hence, different machine learning methods such as neural network, naïve base, decision tree and k-means are used to observe the performance. The results show that the machine learning algorithms proved an efficient performance in classifying and detecting SYN flood attack with extracted features.