# RAPT: A Robust Attack Path Tracing Algorithm to Mitigate SYN-Flood DDoS Cyberattacks
## 4 Performance Evaluation and Results Discussion
### Comparison with Related Work  
In this set of experiments, the proposed RAPT algorithm was compared with TAPPM [21] scheme, which is a collaborative DDoS mitigation framework based on traffic awareness and IP traceback. The authors were motivated by the shortcoming when a DDoS occurs, and the upstream routers might drop most of the traffic before reaching the victim [43]. The authors designed TAPPM for IP traceback and traffic awareness. Using TAPPM, the victim can locate and discover hit routers. The victim then selects the hit routers that are on the attack path as collaborators to limit the forwarding rates aiming to achieve effective and rapid-response against DDoS. The main features of the TAPPM scheme are described below:  
1. The scheme marks packets with tags carrying the traffic semantics and path information, so that the victim can perceive the distribution of the traffic routed to itself;
2. The DDoS traffic discovery is based on traffic volume changes, which allows the victim to trace the attack source generating the malicious traffic and locate the attack point;
3. The scheme collaboratively mitigates DDoS based on traffic awareness and IP traceback, which enables the victim location attack points and selecting some hit routers to act as collaborators. For the sake of comparison, the following performance metrics were considered. The parameters' values are similar to the first set of experiments unless explicitly mentioned in the results' discussions:  
1. **Convergence Time**: This is the time elapsed since the start of attack packets being generated from the attacker(s) until the building of the attack path. The performance of RAPT was compared with TAPPM by running the simulations 15 times over multiple distances, namely, 3, 6, and 9 hops. The results in Figure 11 show that the convergence time is proportional to the distance for both algorithms. This is predictable as the routers on the path need to perform computations and communications for both algorithms; however, RAPT outperforms TAPPM since the attack path will require only one packet to travel between the attacker and the victim. The TAPPM algorithm requires more time and packets from the attacker to realize the attack and select the hit routers, which will mark a significant amount of packets that will be received by the victim to rebuild the attack path. Figure 10: The relationship between the distance of the attack and the ratio of RAPT algorithm processing time to the total simulation processing time. 2. **Robustness**: This metric is used to measure the resilience and scalability of the algorithm against large-scale DDoS attacks. The robustness of RAPT and TAPPM was evaluated in terms of scalability by increasing the number of attackers, that is, when the number of attackers exceeds 15 attackers. Both of the algorithms were evaluated by varying the number of attackers between 5 and 30 running the simulator 15 times for each algorithm and number of attackers. The amount of traffic generated from each attacker is fixed to 5000 packets. The obtained results as depicted in Figure 12 show that, when the number of attackers is less than 15, the average trace time per attack path is better for the TAPPM. This can be due to the fact that, when the number of attackers is low, the attack paths will definitely be low; therefore, less generated attack packets need to be injected in the attack path, which yields a small number of hit routers being collaborative. However, as the number of attackers increases, the average tracing time for the RAPT algorithm significantly performs better. The reason behind this is that the RAPT algorithm is resilient against multi-source/multi-path attacks, thanks to the use of a single tracing packet per path yielding parallel trace packets reaching the victim from multiple sources.