SYN Flood Attack Detection Usiing AR Model

Abstract

Due to the sophisticated characteristics of auto-regressive (AR) modeling approach, it finds applications in most anomaly detection processes. This paper extends the concept of AR modeling to create models for the estimated auto-correlation between data and control planes packet counts of the network traffic. These models are fed with the anomaly traffic containing SYN flood attack. The estimated residuals in these scenarios are used as indicators for the attacks. Simulation results revealed the success of attack detection using the proposed approach.