# RAPT: A Robust Attack Path Tracing Algorithm to Mitigate SYN-Flood DDoS Cyberattacks
## 4 Performance Evaluation and Results Discussion
### Second Experiment Set with Different Topologies  
This experiment set examined the effect of changing the attack distance (hop count) on each of the tracing time, detection time, and processing time. Different topologies were considered with different distances between the attack source and the victim. The Waxman model proposed in [40] is used to create network topology. This Waxman model is a variant of the Erdos-Renyi random graph model in [41] with additional characteristics that are specific to the network. The amount of traffic generated was set to 3000 packets for each of the edge routers. The distances considered are 3, 6, 9, 12 and 15 hops. The rest of the parameters were set as in the first experiment set. The simulator was run 15 times for each of the distances, and the results were averaged.  
The results in Figure 8 show that the relationship between the attack distance and the average detection time is almost independent of the distance and shows no increase in the detection time as the distance increases. This is due to the dependence on the edge routers to detect and initialize the RAPT algorithm and not the distance between the daemon and the victim. This is an advantage to the RAPT algorithm where, unlike other algorithms (as will be shown in the comparison with related work Section 4.5), the attack discovery is performed at the edge routers instead of the victim. This makes use of distributing the attack discovery burden on the network edge to make it proactive.  
In Figure 9, the results indicate that the relationship is almost linear between the attack distance and the attack tracing time. This is due to the need of sending TracePack from router to router on the path. Recall that TracePack is reliably sent using hop-by-hop TCP connections to guarantee the arrival of TracePack. This adds extra delay for tracing. Moreover, packet loss of TracePack will add more delay. However, considering the average hop count over the Internet to be around 15 hops [42], and the tracing time is acceptable being around 15 s.  
Figure 7: The relationship between the amount of traffic and the ratio of RAPT algorithm processing time to the total simulation processing time.  
In Figure 10, it can be noted that the relationship between the attack distance and the processing time ratio to the total simulation time is almost logarithmic. This is because the increase in the attack distance corresponds to an increase in the processing time. Since the processing time is the sum of the processing time for each router (edge + core) on the path between the daemon and the victim, it can be inferred that this increase is reasonable due to the increase in the number of core routers on the path. Recall that, for each attack path, there is one edge router that demands more computations (See Algorithm 1) compared to negligible computations at the core routers (see Algorithm 2). The longer the distance is, the increase in the processing time slightly increases since the dominant amount of processing time is at the edge router that is executed only once per attack path.  
Figure 8: The relationship between the distance of the attack and its detection time.  
Figure 9: The relationship between the distance of the attack and the attack tracing time.