Detecting DDoS attacks by analyzing client response patterns

Distributed Denial of Service (DDoS) attacks is becoming a serious threat on the Internet. Not only network professionals but also end users are now aware of the attacks. Most of these attacks simply flood a massive amount of packets towards a target. In this paper, we propose to detect DDoS attacks by analyzing client response patterns after the reply packets from the server are intentionally delayed. While legitimate clients would react to such delay by decreasing their sending rates, malicious clients would simply keep on flooding the server. The effectiveness of this proposal is evaluated using our prototype.