Packet filtering for congestion control under DoS attacks

Congestion control in IP networks is typically done at each router through queue management, and the network is entirely dependent on the end hosts to react congestion. However, when misbehaving flows exist and continue to send their packets in very high rates, the queue management schemes implemented in current IP routers reveal a significant shortcoming in protecting legitimate flows. Here, we propose a novel scheme for congestion control in IP networks. Our approach is a time-window based filtering mechanism implemented in a router and processed before a queue management policy is applied. Setting the window size properly and dropping packets reaching in the next window can catch the nonresponsive nature of misbehaving flows. The performance of our proposed scheme is demonstrated through extensive simulations using the NS2, simulator using a set of simulated traffic generated based on IP traces reported in http://www.nlnar.org.