A Threshold Adaptation Mechanism for Detecting and Filtering Low-Rate DDoS Attacks

TCP-targeted low-rate distributed denial-of-service (LDDoS) attacks pose a serious chal- lenge to the reliability and security of the Internet. Among various proposed solutions, we are par- ticularly interested in the Congestion Participation Rate (CPR) metric and the CPR-based approach. Through a simulation study, we show that if the algorithm makes use of a fixed CPR threshold, it cannot simultaneously preserve high TCP throughput under attacks and achieve good fairness per- formance for TCP flows without attacks. Then, we propose a method for adaptively changing the threshold over time to achieve both objectives. Simulation results show that our adaptive CPR-based approach can effectively protect TCP flows under attacks while keeping fairness in normal time.