## 6 Conclusions and Future Work  
LDoS attacks constitute a substantial threat to a diversity of stakeholders, including contemporary data centers and critical infrastructures. While such attacks exhibit a high degree of stealthiness and expose a tiny network footprint, they may be particularly effective, ultimately bringing the target network to a grinding halt. Clearly, from a defender's viewpoint, the inherent characteristics of LDoS make them challenging to detect and confront using standard network perimeter controls, including IDS and firewalls. Contributing to the confrontation of this threat, this work introduces a novel MTD strategy that requires zero knowledge of the attack attributes. Essentially, the proposed scheme hinges on iteratively splitting the initial volume of the connections into replica servers to isolate the malicious connections. Through an extensive evaluation process, we demonstrate that by crafily selecting a splitting factor and determining stopping conditions, our strategy can reach an adequate percentage of success, salvaging 80% of the benign connections in less than 5 min. Another key remark is the zero-sum situation between time and resource requirements, meaning that none of the rudimentary splitting schemes we examine is simultaneously effective in both terms. For instance, employing a small splitting factor of 2 necessitates a maximum of 1688 replica nodes, whereas opting for a medium factor of 10 consumes up to 29.03 min to attain a complete solution. An interesting avenue for future work includes devising more advanced partitioning schemes that could potentially incorporate machine learning methods to better balance time and resource utilization. Furthermore, despite that the majority of the evaluated schemes require less than 2000 replicas, replica recycling techniques could be implemented to further reduce resource utilization. Another intriguing direction for future research involves the evaluation of the proposed scheme under real-life attacks, say, Slowloris. In a similar vein, as future work, we aim to explore the behavior of our strategy while considering variant volumes of real-life attack traffic to assess its scalability. Conceptualization, C.K., V.K. and G.M.M. ; methodology, C.K. and V.K. ; software, V.K. and G.M.M. ; validation, V.K. and G.M.M. ; writing--original draft preparation, C.K., V.K. and G.M.M. ; writing--review and editing, C.K., V.K. and G.M.M; supervision, C.K. All authors have read and agreed to the published version of the manuscript. This research received no external funding. We have made available all data, code and experimental procedures. Zenodo reference with all the data: [[https://zenodo.org/records/10963325](https://zenodo.org/records/10963325)]([https://zenodo.org/records/10963325](https://zenodo.org/records/10963325)) Code for Experimental Part: [[https://github.com/georgemakrakis/conn_transfer](https://github.com/georgemakrakis/conn_transfer)]([https://github.com/georgemakrakis/conn_transfer](https://github.com/georgemakrakis/conn_transfer)) Code for Simulation Part: [[https://github.com/byrkam/Partitioning-Defense-Strategy-Simulato](https://github.com/byrkam/Partitioning-Defense-Strategy-Simulato)]([https://github.com/byrkam/Partitioning-Defense-Strategy-Simulato](https://github.com/byrkam/Partitioning-Defense-Strategy-Simulato)) all accessed on 3 April 2024. The authors declare no conflicts of interest. The following abbreviations are used in this manuscript: