# Teletraffic Analysis of DoS and Malware Cyber Attacks on P2P Networks under Exponential Assumptions
## 7 Numerical Results
### P2P System under a Denial of Service Attack  
For this attack, we no longer have infected nodes, but rather, nodes that cannot communicate since they are under a DoS attack. Hence, a malicious node jams the communication capabilities of a certain number of nodes, given by \(\delta s\) and \(\delta l\) in the previously presented model. For a high-level attack, i.e., a node that has the capability of attacking many nodes simultaneously, these parameters will also be high. For a stealthy attack, the attacker may choose a low value for these parameters. In Figure 12, we present the results for a value of \(\delta_{s}=\delta_{l}=5\), for which, when an attack is present, there are five nodes on average jammed by the attacker. We now investigate the system's performance for different conditions of the attack. We first present the evolution in time of the P2P system under this attack, as depicted in Figure 12. For these results, we consider that there is an initial number of five jammed  
Figure 11: Average number of healthy and infected nodes for different numbers of initial malicious nodes, Ni, and efficiency of the countermeasures, PI. peers, and every time the attack is active there are five peers jammed. We can clearly see that, at the beginning of the attack, there are only five seeds jammed in the system that cannot communicate with the rest of their peers. As time passes by, this initial number of seeds decreases since they eventually leave the system. Thereafter, the attack mainly affects the leechers due to the proportion of seeds in the system, i.e., there are much more leechers, and the probability that the node under attack is a leecher is much greater than that it is a seed. We now present the average number of leechers and seeds with and without the jamming attack for different attack intensities. Note that the intensity of the attack directly depends on the number of nodes that are jammed when an attack begins (for the leechers, it is \(\delta_{l}\), and, for the seeds, it is \(\delta_{s}\)) and the average time of such an attack, \(1/\Delta\). Our model is sufficiently flexible to allow the number of leechers and seeds being jammed to be different. This is the case in a more sophisticated attack where the hacker has the capacity to recognize that a node is either a leecher or seed and jam its radio communications for a specific time. For instance, he may choose to jam only seeds, in which case \(\delta_{l}=0\) and \(\delta_{s}>0\), or only leechers where \(\delta_{l}>0\) and \(\delta_{s}=0\). Table 6 shows the case in which the leechers and seeds are affected in the same proportion. It also shows the case in which \(\delta_{s}\) [\(\delta_{l}\)] remains constant and the number of leechers [seeds] under attack varies. These different attack scenarios produce very interesting results, such as the ones presented in Table 6, in which both the leechers and seeds are jammed in the same proportion. We can see that for some peers under the DoS attack, the number of infected peers increases, but this entails a low number of communicating peers, i.e., the number of peers that can actually share their data gets lower and lower until the point at which no communication is possible among peers, and the population is almost zero. These results prove that there is an attacking intensity where the attack can be relatively stealthy, in which peers can still communicate, and the network is still operational. This occurs at the values of \(\delta_{s}\) and \(\delta_{l}\) and affects around 40% of the peers. After this point, the system is severely altered, and the attack would be detected rapidly. Another important result is presented in Table 6, where we can see that if only one population of the system is attacked, either leechers or seeds, only that population decreases to zero.