detected SYN flooding attacks at leaf routers that connect end hosts to the
Internet. They observed that the SYN-FIN packets pair each other in the normal network traffic
and proposed a non-parameter CUSUM method to accumulate these pairs. Cheng [5] utilized the
TTL (Time-To-Live) value in the IP header to estimate the Hop-Count of each packet. The
spoofed packets could be distinguished from normal ones by the Hop- Count deviation. Lemon
[6] incorporated SYN cache and cookies to prevent DDoS attacks, using cache or cookies to
evaluate the security status of a connection before establishing the real connection with a
protected server.