A feedback control defense strategy for denial of service computer attacks

Denial of service (DoS) attacks pose one of the most challenging security issues in computer networks. We propose a defense strategy against DoS attacks, which is based on a local detection component and a feedback control component. The former uses queue content information to detect potential attacks, and the latter controls the sending rate of upstream nodes. We include simulation results to illustrate the behavior of a network when using this strategy under both single-source and distributed DoS attacks, and to show its effectiveness in detecting "potential" attacks at an early stage, identifying attacking flows, and reducing the damage caused by such attacks. Finally, we identify performance metrics appropriate for optimizing the defense mechanism.