# AccFlow: Defending against the Low-Rate TCP DoS Attack in Drones
## 3 AccFlow Design
### Early Drop
Thus, aggregate loss rate is an effective feature to indicate whether the network is under DoS attack or not. The network operators can have different configurations for the threshold \(Th_{1}\) based on their own policies and traffic characteristics. For instance, if they want to aggressively protect their network, they need to set a relatively low threshold for \(Th_{1}\) and vice versa. The main idea of the Early Drop algorithm is that it drops the packets from _accountable_ flows with _reasonable_ probabilities. By \"accountable\", we mean that Early Drop only blames the flows that are accountable for the congestion. By \"reasonable\", we mean  
Figure 6: Aggregate loss rate for normal and attacked scenarios. that Early Drop drops the packets of accountable flows according to their loss rates. We achieve accountability by line 8 of the algorithm. In particular, if a flow only sends one or two packets during one detection period, it is not accountable for the congestion so that Early Drop will not drop its packets. We add the threshold \(Th_{2}\) to make sure that Early Drop will not falsely blame the legitimate TCP flows who have just recovered from retransmission timeouts and send one packet in the beginning of the TCP slow start process to probe the available bandwidth. \(Th_{2}\) should be small and increase with the duration of the detection period since a longer detection period may contain more TCP slow start processes. We set \(Th_{2}\) as 5 in our simulations when we test the effectiveness of AccFlow in the next section. Furthermore, we accomplish reasonability by considering its loss rate while dropping packets from a particular flow (lines 9 to 12). Specifically, Early Drop divides all flows into two groups, i.e., the high loss rate group and the low loss rate group. All flows whose loss rates are above half of the aggregate loss rate \(\mathcal{L}\) will be categorized into the high loss rate group and Early Drop immediately drops their packets according to their loss rates. On the contrary, flows whose loss rates are no greater than half of the \(\mathcal{L}\) will be assigned to the low loss rate group and Early Drop applies packet dropping to these flows only when the number of queueing packets \(N_{packet}\) in the router is larger than \(Th_{3}\). The threshold \(Th_{3}\) is used to indicate that the network is slightly congested so that it is positively related to the router's buffer size. We set \(Th_{3}\) to be 10% of the router's buffer size in our simulations. Again, the network operators can have different configurations for \(Th_{3}\) according to their policies. To sum up, Early Drop blames the flows that are accountable for the congestion, and the higher their loss rates, the more aggressively it drops their packets. The fundamental difference between Early Drop and other Active Queue Management disciplines such as RED and WRED is that Early Drop selectively drops packets from more accountable flows (often the attacking flows) _early_ before the router buffer is exhausted so that the packets from less accountable flows (often the legitimate flows) can be enqueued. However, RED and WRED simply drop all arriving packets when the buffer is full so that the legitimate flows will suffer from denial of service. Note that we can use Aggressive Detection as a supplement to Early Drop. In particular, Early Drop is always active to protect the network whereas Aggressive Detection will be applied to completely block the attacking flows if they perform aggressively enough to be detected by the controller. In the next section, we thoroughly test the effectiveness of AccFlow through substantial amounts of simulations.