Abstract: SYN Flood brings great danger to the normal network operation. Many research studies detect the attack by analyzing the self-similarity of network traffic. However, the method may be ineffective to SYN Flood. By analyzing the high-precision traces which are captured by DAG cards, we proposed a new SYN Flood detection mechanism based on the active detection. It brings the technology of packet pair to abnormal traffic detection that detects SYN Flood, according to the background flow length change. The method has a 88 0 o SYN attack detection rate from experimental resups. This method is based on end-to-end technology which has better flexibility and controllability.

Key words: SYN flooding attack, Self-similarity, Abnormal detection, Packet pair