Date Added: Oct 2009
This paper explores a fast and effective method to detect TCP SYN flooding attack. The Generalized Auto-Regressive Conditional Heteroskedastic (GARCH) model which is the most commonly used statistical modeling technique for financial time series is proposed as a new technique for Denial of service attack detection. The exponential backoff and retransmission property of TCP during timeouts is exploited in the detection mechanism. The authors are able to detect low as well as high intensity SYN flooding attacks by modeling the difference between SYN and SYN+ACK packets using GARCH.