Techniques for Improving Performance of the CPR-Based Approach

Abstract

TCP-targeted low-rate distributed denial-of-service (LDDoS) attacks have created an opportunity for attackers to reduce their total attaking rate (and hence, the detection probability of the attacks) while inflicting the same damage to TCP flows as traditional flooding-based DDoS attacks. CPR-based approach has been proposed by Zhang et al. to detect and filter this kind of DDoS attacks, but its performance in terms of TCP throughput under attack is shown to be limited by the way it calculates CPR for each flow. In this paper, we will propose some modifications to the CPR-based approach in order to increase its performance. Simulation results show that the modifications can increase performance significantly.