期刊名称：International Journal of Security and Its Applications
印刷版ISSN：1738-9976
出版年度：2009
卷号：3
期号：1
出版社：SERSC
摘要：Distributed Denial-of-Service (DDoS) attacks pose a serious threat to Internet security. Traditional detection methods rely on passively detecting an attacking signature and are inaccurate in the early stages of an attack. In this paper, we propose a novel defense mechanism that makes use of the edge routers that connect end hosts to the Internet to store and detect whether the outgoing SYN, ACK or incoming SYN/ACK segment is valid. This is accomplished by maintaining a mapping table of the outgoing SYN segments and incoming SYN/ACK segments and establishing the destination and source IP address database. From the result of simulation, the approach presented in this paper yields accurate DDoS alarms at early stage.
