# AccFlow: Defending against the Low-Rate TCP DoS Attack in Drones
## 5 Experimental Results
### Short Selfish TCP Flow Attack
Therefore, although each individual short TCP flow complies with the TCP protocol, the attackers still behave maliciously by periodically setting up new TCP flows even though the previous flows experience high loss rates. We propose to use _flow aggregation_ to defend against the SSTF attack. Specifically, all flows with the same source IP address will be aggregated as one flow. (It is possible to conduct flow aggregation based on other properties such as source IP address and application port pair. We leave the discussion of different aggregating properties in future works.) Consequently, although flow \(A_{i}\in\mathcal{A}\) and flow \(B_{j}\in\mathcal{B}\) are different flows, they may have the same source IP address since they are both generated by the attackers. As a result, AccFlow will aggregate them as one flow. Therefore, flow \(B_{j}\) will be blamed for the congestion caused by flow \(A_{i}\). Similarly, the subsequent flows will be accountable for the congestion caused by their precedent flows as long as they have the same source IP address. Thus, the attackers are not able to selfishly over-utilize the network resources by creating new flows. A potential problem for conducting such flow aggregation is that attackers can spoof their source IP addresses to keep generating new flows. However, the network security community has proposed effective mechanisms such as Stackpi [32] and packet filters [33] to prevent source IP spoofing. AccFlow can embrace such security protocols to prevent attackers from faking flows. Another potential problem is that the Network Address Translation (NAT) router translates the IP addresses of the hosts within its LAN to its public IP address. Then, all the flows from different hosts will have the same source IP address after they leave the LAN. When they reach other remote sites that deploy AccFlow, they will be aggregated as one flow. Thus, a single compromised host within the LAN may cause denial of service to all the legitimate hosts within the LAN since their flows are aggregated as the same flow. To solve the problem, we can deploy AccFlow on the NAT router so that it will drop the packets from the local attacking flow and save bandwidth for legitimate flows. Therefore, the local attacking flow will not be able to leave the LAN to attack the remote sites. We test the effectiveness of AccFlow when the network is faced with the SSTF attack under similar simulation settings in Table 1. As illustrated in Figure 11, Accountable Flow can effectively defend against the SSTF attack. Note that we set the minimum number of attacking flows to five since the SSTF attack needs to be distributed in order to be effective. The convergence time is also in the order of seconds to tens of seconds. We do not present the results for the convergence time in the paper due to space constraints. Note that the achieved data rates (throughput) for higher rate flows, i.e., ones with rates of 0.9 Mbps  
Figure 10: Effectiveness of the SSTF attack. and 1.1 Mbps, are slightly less than their desired data rates. We attribute such slight performance degradation to the fact that TCP max-min fairness serves the low rate flows first in congested networks.