Input: Unknown Visitor A

Output: Attack detection result

1) Run pfsense;

2) Run snort and add rules;

3) If IP(A) == IP (Black List), block the visitor A;

4) If A matches the snort rules, an alert is issued and blocked ← IP(A).

The algorithm can successfully detect the DoS attack initiated by the attacker, add the attacker’s IP to the block list, and successfully block the IP.