[Paper Review] Defense against SYN-Flood Denial of Service Attacks Based on Learning Automata

Masoud Bekravi, Shahram Jamali+1 more|arXiv (Cornell University)|Aug 24, 2012

Network Security and Intrusion Detection26 references3 citations

TL;DR

This paper proposes a self-managing defense against SYN-flood denial-of-service attacks using learning automata to dynamically optimize two key TCP parameters: the maximum number of half-open connections (m) and the hold time (h). By formulating the defense as an optimization problem and applying learning automata, the approach significantly reduces connection loss probability (Ploss), minimizes buffer occupancy by attack traffic (Pa), and improves buffer utilization for legitimate requests (Pr), as validated through simulation results.

ABSTRACT

SYN-flooding attack uses the weakness available in TCP's three-way handshake process to keep it from handling legitimate requests. This attack causes the victim host to populate its backlog queue with forged TCP connections. In other words it increases Ploss (probability of loss) and Pa (buffer occupancy percentage of attack requests) and decreases Pr (buffer occupancy percentage of regular requests) in the victim host and results to decreased performance of the host. This paper proposes a self-managing approach, in which the host defends against SYN-flooding attack by dynamically tuning of its own two parameters, that is, m (maximum number of half-open connections) and h (hold time for each half-open connection). In this way, it formulates the defense problem to an optimization problem and then employs the learning automata (LA) algorithm to solve it. The simulation results show that the proposed defense strategy improves performance of the under attack system in terms of Ploss, Pa and Pr.

Motivation & Objective

• To address the growing threat of SYN-flood denial-of-service attacks that exploit TCP's three-way handshake to exhaust system resources.
• To reduce the performance degradation caused by high connection loss probability (Ploss), elevated attack buffer occupancy (Pa), and reduced legitimate request handling (Pr).
• To develop an adaptive defense mechanism that autonomously tunes TCP parameters (m and h) in real time without prior knowledge of attack patterns.
• To improve system resilience under sustained SYN-flood attacks by optimizing resource allocation between legitimate and malicious connections.
• To validate the effectiveness of the proposed learning automata-based approach through simulation under realistic attack conditions.

Proposed method

• The defense mechanism formulates the SYN-flood mitigation problem as an optimization task to minimize Ploss and Pa while maximizing Pr.
• Learning automata (LA) are employed to dynamically adjust two system parameters: m (maximum half-open connections) and h (hold time for each half-open connection).
• The LA algorithm learns the optimal parameter settings through repeated interactions with the network environment, using feedback in the form of performance metrics (Ploss, Pa, Pr).
• The learning process is based on reinforcement learning principles, where the automaton receives rewards or penalties based on system performance after each parameter adjustment.
• The system continuously monitors incoming connection requests and adapts m and h in real time to balance connection acceptance and resource protection.
• The approach is simulation-based, using a controlled environment to evaluate the impact of dynamic parameter tuning on attack resilience.

Experimental results

Research questions

• RQ1 How can a self-managing system dynamically tune TCP parameters to defend against SYN-flood attacks without prior knowledge of attack characteristics?
• RQ2 To what extent can learning automata reduce connection loss probability (Ploss) during a SYN-flood attack?
• RQ3 Can the dynamic adjustment of m and h improve buffer utilization for legitimate requests (Pr) while minimizing buffer occupancy by attack traffic (Pa)?
• RQ4 How does the proposed learning automata-based defense compare to static parameter configurations in terms of system resilience under attack?
• RQ5 What is the convergence behavior and stability of the learning automata in optimizing m and h under varying attack intensities?

Key findings

• The proposed learning automata-based defense significantly reduces the probability of connection loss (Ploss) under SYN-flood attack conditions.
• Buffer occupancy by attack requests (Pa) is effectively minimized through dynamic tuning of m and h.
• The proportion of buffer space allocated to legitimate requests (Pr) is substantially increased, improving system availability.
• The system demonstrates stable convergence of the learning automata to optimal parameter settings across multiple attack scenarios.
• Simulation results confirm that the dynamic optimization approach outperforms fixed-parameter configurations in maintaining system performance during attacks.
• The method achieves a balanced trade-off between connection acceptance and resource protection, enhancing overall system resilience.