SYN Flooding Detection and Mitigation using NFV

A SYN flooding DDoS attack aims to consume the CPU and memory resources of servers that run online services. While hardware-based firewalls play a critical role in network security, they are limited to the resource capacity. Consequently, extreme traffic of DDoS attack renders firewalls and servers inoperational. Therefore, this article presents a defense model against DDoS attacks. The model includes a detection algorithm using DBSCAN clustering. When the algorithm detects SYN patterns, new security rules are automatically generated to block the attack. The proposed solution is to be deployed on Network Functions Virtualization (NFV) where all networking and security functions are software-based instead of hardware-based. Our solution takes advantages of the scalability and automation of NFV to maintain service during DDoS attacks.