## 4 Proposed Solution
### Toy Examples  
To aid the reader in better understanding the proposed solution, we provide two comprehensive examples illustrating the two aforementioned naive strategies.  
**Example 1**.: _Consider eight total connections handled by a single server; therefore, the initial configuration is \(\Phi=\{c_{1},\ c_{2},\ c_{3},\ c_{4},\ c_{5},\ c_{6},\ c_{7},\ c_{8}\}\). Let us assume that two connections \(\mathcal{M}=\{m_{1}=c_{7},m_{2}=c_{8}\}\) are malicious. This information is unknown to the defender. With reference to Section 3.2, for this example, the splitting factor is set to two. The stopping criterion is set to four total replicas. In the first epoch, the defense spawns two new nodes and partitions the active connections in half. After this step, the active configuration is \(u_{1}=\{c_{1},\ c_{2},\ c_{3},\ c_{4}\}\) and \(u_{2}=\{c_{5},\ c_{6},c_{7},\ c_{8}\}\). During the end of the first iteration, the status of each node is re-evaluated. Node Replica 1.A consists of benign-only connections. The node is considered a healthy node and the corresponding connections are all flagged as safe and are excluded from future shuffling and partitioning rounds. Node Replica 1.B indicates an ongoing attack. An additional partition will be performed. During the second iteration, two new nodes are created, redistributing the active connections accordingly. By the end of this epoch, the configuration is the following: \(u_{3}=\{c_{5},\ c_{6}\}\) and \(u_{4}=\{c_{7},\ c_{8}\}\). The status of the two nodes is re-evaluated. Node Replica 2.B is a healthy node. Node Replica 2.C still indicates an ongoing attack. The process stops because the total number of replicas created is 4. Despite the stopping criterion, the scheme reached a perfect solution._  
**Example 2**.: _Consider eight total connections handled by a single server. Therefore, the initial configuration is \(\Phi=\{c_{1},\ c_{2},\ c_{3},\ c_{4},\ c_{5},\ c_{6},\ c_{7},\ c_{8}\}\). Let us assume that two connections \(\mathcal{M}=\{m_{1}=c_{4},m_{2}=c_{8}\}\) are malicious. For this example, the split step is set to four. No stopping criterion is defined. In the first epoch, the defense spawns four new nodes and distributes the connections accordingly. After this step the active configuration is \(u_{1}=\{\ c_{1},\ c_{2},\ \mu_{2}=\{\ c_{3},\ c_{4}\},\)\(u_{3}=\{\ c_{5},\ c_{6},\ \},\) and \(u_{4}=\{\ c_{7},c_{8}\}\). During the end of the first epoch, the status of each node is re-evaluated. Nodes \(u_{1},u_{3}\) are healthy and excluded from subsequent iterations. An additionalpartition is performed. During the second iteration, eight new nodes are supposed to be spawned, but since there are only four connections only four nodes are created, namely \(u_{5}=\{\ c_{3}\}\), \(u_{6}=\{\ c_{4}\}\), \(u_{8}=\{\ c_{7}\}\), and \(u_{4}=\{c_{8}\}\). Once again, the process reaches a complete solution._  
In view of both the aforementioned examples, it is essential to emphasize that our strategy lacks (does not depend on) any prior knowledge about the nature of each connection, i.e., if it is benign or malicious. Recall that, in practice, attackers can craft LDoS attacks in such a way that they resemble data flows of legitimate users at a very slow rate [23]. Given this characteristic of the LDoS attacks, the deployment of the proposed scheme is only based on basic _indicators_ of abnormality. Note that the term _indicator_ is intentionally left ambiguous, as it often involves a highly empirical process that may require manual human input.