# AccFlow: Defending against the Low-Rate TCP DoS Attack in Drones
## 5 Experimental Results
### Distributed Low-Rate TCP DoS Attack
The results show that AccFlow can also effectively defend the network even if attackers are able to change their attack rates. Here, we make a detailed explanation of the effectiveness of AccFlow. Consider one legitimate TCP flow and one attacking flow in our simulations. Assume that attackers launch DoS attacks in the detection period \(T_{k}\). Due to severe packet losses in \(T_{k}\), the legitimate TCP flow envisions a heavily congested network and enters a retransmission timeout. Therefore, in the next detection period \(T_{k+1}\), either its loss rate is zero if it is still waiting in the timeout or its usage is very low if it just recovers from the timeout and sends small amounts of packets to probe the available bandwidth. Under both scenarios, AccFlow will not further blame the legitimate flow. However, the attackers have to continuously send high volumes of traffic in order to overflow the bottleneck link. Thus, the attacking flow still has a large usage in the next detection period \(T_{k+1}\) in spite of its high loss rate in \(T_{k}\). Under such a situation, AccFlow will Early Drop its packets according to its loss rate. Furthermore, if the network is still congested after Early Drop, the router itself will also drop packets since it cannot deal with so much traffic. Therefore, the attacking flow will experience an even larger loss rate in the detection period \(T_{k+1}\). This cycle repeats so that the loss rate of the attacking flow increases in each detection period until the network is not congested or its loss rate equals one. Under both scenarios, the attacking flow can no longer harm the network. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Simulation** & **Legitimate TCP Flows** & **Attack Scales** & **Aggregate Attacking Rate** \\
**Setting** & & & \\ \hline Setting One & 5 flows with same rate 1 Mbps & 1 to 50 attacking flows & 30 Mbps \\ \hline Setting Two & \
\begin{tabular}{c} 9 flows with different rates ranging \\ from 0.3 Mbps to 1.1 Mbps \\ \end{tabular} & 1 to 50 attacking flows & 30 Mbps \\ \hline Setting Three &
\begin{tabular}{c} 9 flows with different rates ranging \\ from 0.3 Mbps to 1.1 Mbps \\ \end{tabular} & 5 attacking flows & 20 Mbps to 60 Mbps \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Simulation settings. In order to be a real-time defending technique, AccFlow needs to react to attacks very fast. Here, we study the convergence time of AccFlow, i.e., how long it takes AccFlow to clear up the attacks. We define the convergence time as the time when all legitimate flow loss rates are zero. Without loss of generality, we randomly pick up one simulation setup in each of the three settings listed in Table 1 to study its convergence time. Specifically, we test the scenarios where attackers set up 20 and 30 attacking flows in setting one and setting two, respectively. As for setting three, we use the case when attackers are generating traffic at a rate of 40 Mbps. Our simulation results are illustrated in Figure 9. Under all three scenarios, AccFlow can react to the attack quickly and the convergence time is in the order of seconds or tens of seconds. As a flow-based defending technique, AccFlow needs to be scalable to deal with large numbers of attacking flows. Although the performance of AccFlow does not decline as the number of attacking flows increases (as illustrated in our simulation results), huge numbers of flows will exhaust the CPU and storage of the centralized controller. We discuss the scalability problem and propose our solutions in Section 4 where we consider the deployment of AccFlow in real networks.