Ddos flood and destination service changing sensor

Fu Hau Hsu, Chia Hao Lee, Chun Yi Wang, Rui Yi Hung, Yungyu Zhuang

Research output: Contribution to journalArticlepeer-review

2 Scopus citations


In this paper, we aim to detect distributed denial of service (DDoS) attacks, and receive a notification of destination service, changing immediately, without the additional efforts of other mod-ules. We designed a kernel-based mechanism to build a new Transmission Control Protocol/Internet Protocol (TCP/IP) connection smartly by the host while the users or clients not knowing the location of the next host. Moreover, we built a lightweight flooding attack detection mechanism in the user mode of an operating system. Given that reinstalling a modified operating system on each client is not realistic, we managed to replace the entry of the system call table with a customized sys_connect. An effective defense depends on fine detection and defensive procedures. In according with our experiments, this novel mechanism can detect flooding DDoS successfully, including SYN flood and ICMP flood. Furthermore, through cooperating with a specific low cost network architecture, the mechanism can help to defend DDoS attacks effectively.

Original languageEnglish
Article number1980
Pages (from-to)1-17
Number of pages17
JournalSensors (Switzerland)
Issue number6
StatePublished - 2 Mar 2021


  • DDoS attack
  • Live migration
  • Loadable kernel module
  • Network security
  • TCP three-way handshake


Dive into the research topics of 'Ddos flood and destination service changing sensor'. Together they form a unique fingerprint.

Cite this