Implementation of anomaly detection algorithms for detecting transmission control protocol synchronized flooding attacks

Abstract

This work implements two anomaly detection algorithms for detecting Transmission Control Protocol Synchronized (TCP SYN) flooding attack. The two algorithms are an adaptive threshold algorithm and a cumulative sum (CUSUM) based algorithm. Furthermore, we fused the outcomes of the two algorithms using the logic OR operator at different thresholds of the two algorithms to obtain improved detection accuracy. Indeed, the results indicated that the OR operator performs better than the two algorithms in detecting SYN flooding attack and detection delay.