## 4 Implementation
### Monitoring Model
#### 4.3.3 Consensus  
The next step of the detection procedure is to accumulate information gathered from all path-messages, in order to be able to detect attacks executed from the network of protected installations. The information of each path-message, as this was filtered in the previous step, exists in different agents. In practice, it has been extracted from the agent at which each path-message has reached its maximum length. A light-weight consensus algorithm is then required, in order to collaboratively identify executions of DDoS attacks through data lying at different agents. The mechanics of this consensus mechanism are analyzed in Section 5.  
Firstly, every agent checks if the packet rate of the busiest host of a specific path-message, denoted \(h_{m}\), is at least twice that of the second busiest host of the same path-message. In that case the busiest host is a candidate victim and all such filtered entries (busiest hosts of path-messages) are concatenated for the running time slot. The one with the highest detection ratio is elected as the global candidate victim for the specific time slot.  
If the global candidate victim is the same for at least three consecutive time slots, then that host is identified as probable DDoS victim and an alert is produced. There will be cases where a candidate victim \(h_{m}\) is not actually a victim but it just receives a large number of packets during its normal operation. In this case, it is statistically improbable that this host is proposed as a candidate victim in consecutive time steps, as it has been shown from the simulation in Section 6. On the other hand, when a real DDoS attack occurs, the real victim will satisfy the requirement of being proposed as a global candidate in many consecutive time slots, hence the above approach has been followed.  
The described approach is based on the fact that path-messages hold accumulated information from all agents they have passed through. They do not store information only from the agent at which they reached the maximum length and at which they have been evaluated. In practice, candidate victims are the hosts to which a significant packet incoming rate has been summed up from data collected in random subset of agents. Even when a host is not being attacked but just receives a high rate of traffic from specific installations, the probability that the agents of those installations will co-exist in the path of the same path message is rather limited. Consequently, the high rates submitted by the agents corresponding to those installations will be averaged out by the rest of the agents that the path-message has passed through. On the other hand, actual victims tend to receive traffic from significantly more installations and the probability of a path mainly consisting of the agents from such installations is higher.  
At some point in time it is probable that the protocol will filter in hosts, that simply happen to receive more traffic than others and are not victims of a DDoS attack. This is very unlikely to happen consistently for the same host in different path-messages and thus, the requirement of having a specific host as global candidate for consecutive time slots filters out such false alerts.