## 2 Taxonomy of DDoS Attacks
### DDoS Attack Architecture
Table 2 displays a comparison of the two DDoS attack architectures. The security in the centralized architecture is very strong because the botnet cannot be detected just by identifying the communications between the bots. Unlike the decentralized architecture, the P2P communication pattern between the bots may be recognized, which makes the botnet easier to identify. Once the botnet is discovered, the source of the attack may be determined, and the strength of such attacks becomes almost negligible. Additionally, the attacker can simply modify their attack strategy through real-time control of the botnet in the centralized architecture. The authors proposed a new low-cost architecture that consists of a DDoS attacker, a target server, and a botnet. In this architecture, an attack strategy is achieved by only writing a malware bot with an attack module. This eradicates the botnet management issues that are present in other architectures. Thus, the management cost is zero. Since there is no command-and-control system, the proposed architecture is robust and suitable for resource-constrained devices. Irrespective of the architecture, a DDoS attack shares a common goal. As shown in Figure 3, the bots under the control of the handlers send out the attack packets. These packets converge at the target server to exhaust its resources. Server resource exhaustion can occur due to a server's bandwidth, memory size, or CPU cycle [38, 39]. [PERSON] and [PERSON] [38] describe the probability of bandwidth exhaustion using (1) [38]:  
\[P_{B}=\frac{\left(\frac{a^{c}}{a^{c}}\right)}{\sum\limits_{i=0}^{c}\frac{a^{ i}}{1!}} \tag{1}\]  
where the following definition is used:  
\[a=\frac{1}{B_{T}}\left[\frac{\delta_{BA}}{\tau_{BA}}+\frac{\delta_{BN}}{\tau_{ BN}}\right] \tag{2}\] \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Architecture** & **Advantages** & **Limitations** \\ \hline \multirow{3}{*}{Centralized architecture} & \(\bullet\) & Security is strong. & \(\bullet\) & Cost of managing a botnet is high. \\  & \(\bullet\) & Flexible & \(\bullet\) & Not robust. \\ \hline \multirow{3}{*}{Decentralized architecture} & \(\bullet\) & Robust & \(\bullet\) & Security is weak. \\  & \(\bullet\) & Flexible & \(\bullet\) & Cost of managing a botnet is high. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparison of the DDoS attack architectures. Figure 3: Architecture of a DDoS attack: (**a**) centralized, (**b**) decentralized. In (1), \(P_{B}\) denotes the probability of bandwidth exhaustion, \(c\) is the number of unused bandwidths, and \(B_{T}\) is the total bandwidth consumed. The packet sizes of the attacking and legitimate clients are represented by \(\delta_{BA}\) and \(\delta_{BN}\), respectively. \(\tau_{BA}\) is the inter-arrival rate of the attacking packet, while \(\tau_{BN}\) is that due to the legitimate packet. In a situation where the packet due to the attack and the legitimate client are of the same size, \(\delta_{BA}=\delta_{BN}=\delta_{B}\). Then, \(a\) is expressed as [38] follows:  
\[a=\frac{\delta_{B}}{B_{T}}\bigg{[}\frac{1}{\tau_{BA}}+\frac{1}{\tau_{BN}} \bigg{]} \tag{3}\]  
\[a=k\times\frac{1}{\tau_{BA}} \tag{4}\]  
These expressions show that the inter-arrival rate of the attacking traffic has a significant impact on the probability of bandwidth depletion. In this model, the distribution due to the legitimate client is Gaussian, whereas the arrival rate of the packet from the attacking client is modelled via Poisson distribution. The overall probability of depletion of the victim's resources \(P_{TA}\) is expressed using (5) [38]:  
\[P_{TA}=1-(1-P_{B})(1-P_{M}) \tag{5}\]  
where \(P_{M}\) is the probability due to memory consumption. [PERSON] et al. [39] used a simple congestion window model to describe the probability of a successful attack on the bandwidth.