Application of anomaly detection algorithms for detecting SYN flooding attacks

TLDR

The study investigates statistical anomaly detection algorithms for detecting SYN flooding attacks, focusing on how algorithm parameters and attack characteristics affect tradeoffs among detection probability, false‑alarm ratio, and detection delay. The authors evaluate an adaptive threshold algorithm and a cumulative sum (CUSUM) change‑point detection method, measuring detection probability, false‑alarm ratio, and detection delay. The analysis yields guidelines for tuning algorithm parameters to meet desired detection probability, false‑alarm ratio, and detection‑delay targets.

Abstract

We investigate statistical anomaly detection algorithms for detecting SYN flooding, which is the most common type of denial of service (DoS) attack. The two algorithms considered are an adaptive threshold algorithm and a particular application of the cumulative sum (CUSUM) algorithm for change point detection. The performance is investigated in terms of the detection probability, the false alarm ratio, and the detection delay. Particular emphasis is on investigating the tradeoffs among these metrics and how they are affected by the parameters of the algorithm and the characteristics of the attacks. Such an investigation can provide guidelines to effectively tune the parameters of the detection algorithm to achieve specific performance requirements in terms of the above metrics.