This paper presents a simple but fast and effective method

to detect TCP SYN flooding attacks. Linear prediction analysis is

proposed as a new paradigm for DoS attack detection. The proposed

SYN flooding detection mechanism makes use of the exponential backoff

property of TCP used during timeouts. By modeling the difference

of SYN and SYN+ACK packets, we are successfully able to detect an

attack within short delays. We use this method at leaf routers and

firewalls to detect the attack without the need of maintaining any state.