Economic Enforcement Without Classification: A Market-Based Defense Against Resource Exhaustion Attacks

Preprint. arXiv submission pending endorsement. Fairness-oriented CPU schedulers assume processes arrive in good faith. Resource exhaustion attacks exploit this assumption and degrade system availability through sheer consumption. Detection-based defenses fail against unknown or adaptive adversaries and introduce classification overhead that becomes an attack surface itself. This research presents the Arabian Market Protocol (AMP), a market-based process scheduling architecture that enforces economic constraints at the scheduling layer to bound resource exhaustion without process classification. Each process holds a Sijil record that contains a finite execution budget. CPU time is allocated through a bidding mechanism that debits granted execution from the process budget. Process creation requires payment of a spawn fee from the parent budget. This bounds the total number of identities an adversary can introduce. Processes that exhaust their budgets transition through defined states and receive no further execution at bankruptcy. Using 2000-tick simulations, AMP is evaluated against a Round Robin baseline across two structurally distinct attack classes. Against fork bomb attacks, spawn fee enforcement bounds process amplification and produces attacker bankruptcy at aggressive fee configurations. The critical process sustains 400 dispatches across the full simulation window, compared to a single dispatch before structural starvation under Round Robin. Against cryptojacking attacks, the throttle mechanism drives the attacker to a permanently marginalized state at tick 9. The critical process sustains 400 dispatches and captures 71.8% of dispatch events, compared to 200 under Round Robin. Neither outcome involves process classification. Later experiments identify two additional constraints: AMP enforces an implicit budget-rate ceiling that traps any process with sustained demand above MINT_RATE_ACTIVE_MS, and a pulse adversary operating at 30% duty cycle evades throttle-based marginalization entirely; this extracts 200 dispatches without ever entering THROTTLED. Both findings are disclosed and characterized. These results establish that economic enforcement at the scheduling layer produces structurally distinct responses to distinct attack classes without requiring the scheduler to identify which processes are adversarial.