TCP SYN flood detection based on payload analysis

Abstract

Transmission Control Protocol (TCP) Synchronized (SYN) Flood has become a problem to the network management to defend the network server from being attacked by the malicious attackers. The malicious attackers can easily exploit the TCP three-way handshake by making the server exhausted and unavailable with spoofed Internet Protocol (IP) address. The main problem in this paper is how to detect TCP SYN flood through network. This paper used anomaly detection to detect TCP SYN flood attack based on payload and unusable area in Hypertext Transfer Protocol (HTTP). The results show that the proposed detection method can detect TCP SYN Flood in the network through the payload.