The DRR-based approach of defending against LDoS

Abstract

The low-rate denial of service (LDoS) attack is known as a low-rate TCP attack with essentially a periodic short burst, which exploits the homogeneity of the minimum retransmission timeout (RTO) of TCP flows and forces all affected TCP flows to back off and enter the retransmission timeout state. LDoS attack is new threat to Internet and ISP service. This paper adopts the deficit round robin (DRR) algorithm to defend against LDoS attack. DRR algorithm provides bandwidth allocation and protection between flows to improve the throughput of all the TCP flow. Experiments on single low-rate attack on single TCP flow and multiple TCP flows show that DRR has an expected effect on resisting LDoS attack.