# AccFlow: Defending against the Low-Rate TCP DoS Attack in Drones
###### Abstract
to solve the scalability problem so that our protocol can be deployed in both Local Area Networks (LANs) and WANs. The reason why the low-rate TCP DoS attack and other kinds of DoS attacks work well is that whenever a congestion happens, the router drops the packets from all flows regardless of who causes the congestion. In other words, _accountability_ for the congestion is not considered for packets dropping [17]. As a result, even legitimate TCP flows that diligently adhere to the congestion avoidance protocol and transmit at reasonable rates are erroneously affected by congestion. This congestion is primarily caused by attacking flows that flood the network with large volumes of traffic, depleting available bandwidth. Therefore, in order to effectively combat DoS attacks, AccFlow considers congestion accountability when implementing packet drops. To be precise, the more accountable flows are to contribute to the congestion, the more assertively AccFlow drops their packets. We establish a connection between each flow's accountability for congestion and its loss rate. Essentially, the higher the loss rate, the greater the flow's accountability to cause congestion. This connection is rooted in the behavior of attacking flows, which consistently exhibit high loss rates due to their higher accountability for congestion. They do so because they must continually send an excessive number of packets to overwhelm the network. In contrast, legitimate TCP flows, with their lower accountability for congestion, rarely experience consistently high loss rates. Instead, they adapt by reducing their transmission rates and may even enter timeouts when their packets are dropped. As a result, there is a positive correlation between a flow's loss rate and its accountability for causing congestion. AccFlow safeguards the network by prioritizing the dropping of packets from flows with higher loss rates and corresponding higher probabilities. Conversely, packets from flows with lower loss rates are dropped with lower probabilities. Through extensive simulations using ns-3 [18], we illustrate that AccFlow proves effective in defending against both the low-rate TCP DoS attack and general DoS attacks. In summary, this paper makes the following contributions. * AccFlow is the first SDN-based security protocol that considers flow accountability when defending against DoS or DDoS attacks. * We demonstrate that AccFlow, which does not cause any performance degradation to benign flows, can effectively defend against both the low-rate TCP DoS attack and general DoS attacks even if attackers are able to vary their strategies. * We use flow aggregation and virtual centralized controller to solve the scalability problem of AccFlow and make it deployable in real networks. The rest of the paper is organized as follows. In Section 2, we give a brief introduction to the low-rate TCP DoS attack. In Section 3, we elaborate on the AccFlow protocol. InSection 4, we consider the deployment of AccFlow in real networks and its interaction with other security protocols. In Section 5, we thoroughly study the effectiveness of AccFlow in different simulation settings. Finally, we conclude in Section 6.