一种新的过滤SYN洪水攻击的方法

本文提出了一种新的过滤SYN 洪水攻击的方法。这种方法（故意丢弃过滤）通过观
察客户的协议一致性行为判定客户的请求是否正常。它的主要思想是故意丢弃每个连接请求上的第一个SYN 数据包，后续的SYN 只有遵守TCP 超时与重传机制才能通过。分析表明，我们的方法能有效地降低攻击的成功率，同时连接建立的延迟也是可以接受的。
关键字：SYN 洪水；超时与重传机制；协议一致性；故意丢弃；边界路由器
Abstract: This paper presents a novel scheme for filtering SYN flooding attacks.
The scheme (Purposive Discarding based Filtering) decides whether the client’s
request is legitimate or not by observing client’s protocol consistency behavior.
The main idea is to purposely discard the first SYN packet of each connection request.
Subsequent SYN packet from a request is passed only if it adheres to the TCP’s
timeout and retransmission mechanism. Our analysis shows that the proposed scheme
reduces the attacker’s successful attack rate significantly with an acceptable
increase in connection establishment delay.
Keyword: SYN flooding; timeout and retransmission mechanism; protocol consistency;
purposive discarding; edge router