# AccFlow: Defending against the Low-Rate TCP DoS Attack in Drones
## 3 AccFlow Design
### Early Drop  
Early Drop is proposed to effectively deal with the aforementioned distributed attacks. The design of Early Drop is also based on consistent flow monitoring and periodic flow analysis by the centralized controller. However, Early Drop does not purely rely on the ULR to detect attacking flows. In fact, Early Drop is a heuristic algorithm illustrated in Algorithm 1 that conducts flow-based packet dropping according to each flow's loss rate without explicitly detecting attacking flows. Next, we elaborate on the Early Drop algorithm. The algorithm is executed during every detection period. The first 4 lines of the code are executed only once at the beginning of each detection period, whereas the remaining lines are executed whenever a packet arrives within that detection period. The aggregate loss rate, denoted as \(\mathcal{L}\) (line 2), represents the ratio of the number of dropped packets from all flows in the _previous_ detection period to the total number of arriving packets in the _previous_ detection period. Similarly, usage \(U_{i}\) of flow \(F_{i}\) (line 4) reflects the number of packets sent by \(F_{i}\) in the previous detection period. Loss rate \(L_{i}\) of \(F_{i}\) (line 4) is calculated as the ratio of the number of dropped packets from \(F_{i}\) in the previous detection period to \(U_{i}\). It is important to note that these values, namely\(\mathcal{L}\), \(U_{i}\), and \(L_{i}\), are computed based on statistics from the previous detection period. In the event that the current detection period is the first, the controller initializes all these values to zero. These values remain constant within the current detection period and are updated at the start of the subsequent detection period. The rest of the lines of the codes, starting from line \(5\) to the end, execute the packet-dropping policy based on these calculated values. We add a condition \(\mathcal{L}>Th_{1}\) in line \(5\) for packet dropping. This is because Early Drop initiates packet dropping before the network bandwidth is fully exhausted. Therefore, it is necessary to make sure that the network is being attacked before applying such an aggressive dropping policy. In other words, Early Drop is a self-protective mechanism that automatically begins dropping packets when the network shows a sign of being attacked. We use aggregate loss rate to verify whether the network is being attacked or not for the following reasons. This approach is grounded in the behavior of legitimate TCP flows, which adhere to congestion-avoidance protocols. When packets are lost due to substantial congestion, legitimate flows respond by throttling their transmission rates, aligning them with the available bandwidth. Consequently, even if these flows initially have high original transmission rates, they adjust their data rates to match the prevailing network conditions. Therefore, it is rare for the network to witness a consistently high aggregate loss rate under normal situations. However, when attackers are trying to cause denial of service to legitimate flows by exhausting the network bandwidth, they have to  
Figure 5: ULR of each flow under distributed DoS attack. continuously generate traffic even though many of their packets are dropped, i.e., they never back off when meant to do so. As a result, the network will experience a very high aggregate loss rate under attack. We verify our analysis by studying the aggregate loss rate in both normal and attacked scenarios. The experimental results, illustrated in Figure 6, show that even 40 legitimate flows each with the original 1 Mbps transmission rate are traversing the 10 Mbps bottleneck link, the aggregate loss rate is well below 10% (the real network is always bandwidth over-provisioned to tolerate the traffic burst caused by legitimate flows, which makes it rare for the network to have a large aggregate loss rate under normal situation). However, when the attackers are trying to launch an attack, the aggregate loss rate is more than 65%.