## 6 Simulation and Results
### Detection Capability
From Figure 4 it is obvious that during the attack the detection ratios calculated for victim host \(h_{v}\) tend to be significantly higher levels than the corresponding values for all other hosts. The attack takes place in time window between time slot 500 and time slot 750. The results that correspond to this attack span in a larger time window up until time slot 900. This is normal as path-messages that have gathered information during the time of attack are evaluated after the end of the attack and produce corresponding results approximately up until time slot 900. Consequently, the path-messages detection ratio values that have been filtered in from all agents are concatenated in chronological order. The produced set of records mainly contains reports concerning the host \(h_{v}\). Figure 5 shows records for all filtered in path-messages for the 10,000 IoT devices network with a 1% infection ratio (\(c=0.3\)). It depicts all path-messages for which packet rate of the busiest host is at least double that of the next busiest host. The red marks correspond to path-messages of the actual victim host \(h_{v}\), while the blue ones correspond to path-messages for any other host. It is spotted that during the attack most of the records filtered in relate to \(h_{v}\). However, before and after the attack there are also multiple records for other hosts. Figure 4: 5000 IoT devices, 3% infection ratio, 0.3 max path-message length. In order to efficiently detect a DDoS attack going on, a requirement for multiple consequent appearances (in consequent time slots) of the same host as candidate victim was discussed in Section 4. This step practically discards all records, irrelevant to DDoS attacks, that have been filtered in due to extreme traffic conditions or any other cause. The consequent records requirement is valid only for records relevant to actual DDoS attacks. The records that satisfy this requirement are finally outputted as DDoS attacks alerts. The relative tests have produced zero false positives in all scenarios. Regarding the 1% infection ratio scenarios (the hardest case), the system has produced 89, 70, and 130 alerts for the 5000, 7500, and \(10,000\) IoT devices' networks. These results have been produced by setting a value of 0.3 for the \(c\) coefficient. It is evident that there may be rare cases where benign traffic may be identified as part of DDoS attacks. For example, in the case of IP cameras, if multiple deployed devices utilize a single common point of storage, then the traffic created by video streams uploading procedure resembles that of a DDoS attack against the storage point. In general, it is expected that such cases are rare and do not exhibit the dispersion of source nodes that actual DDoS attacks do. Limited source hosts dispersion means limited probability of triggering an alert. Of course, such cases cannot be neglected, but on the other hand, hosts that are expected to receive such traffic are known beforehand and a list of such hosts may be maintained. In practice, alerts can be filtered as they are produced, according to the candidate victim host or agents may use a white-list of hosts expected to receive multiple connections and exclude corresponding traffic metrics from path-messages.