Design And Implementation Of SYN Flood Attack Detection System Based On The Bloom Filter

As Web2.0developed, UGC is more popular and Internet security is faced more threat and becoming more important. Distributed denial of service attacks lead to a large number of users can not normally get to data and services, the economic and political life will be influenced greatly. SYN flood attack is easy implementation and often happened in recent years. The research of SYN attacks have become the preferred method to curb the distributed denial of service attacks effectively with high research value.The topic of this paper is to discuss a better way to detect it, so we analysised its principle, and develop a system to get the feature and then make evaluation, based on the accumulated sum and make a dynamic detection methods to achieve the target. As SYN flood attack is special with its large flow, faked source-IP, and unpredictable feature, it is a better way to using bloom filter to get the feature, and we optimize its structure. Before detection started we have defined parameters of the system such as the number of the hash function. We compare the sum with dynamic threshold, determined by the average data feature flow, so the system can adapt any situation. The system is developed by Java, and be devided into serveral modules with low coupling, easy implementation. The experiment showed that our method is low false rate and small mem-cost, is suitable for using as a reference of project practice.