# Stability of SDE-LJN System in the Internet to Mitigate Constant-Rate DDoS Attacks

Authors: Kaijiao Huang; Liansheng Tan; Gang Peng
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The Internet is nowadays suffering dramatically serious attacks, with the distributed denial of service (DDoS) attacks being the representative and dominant ones. It is seen that, to stabilize the buffer queue length around a given target under DDoS attacks in the relevant routes is vitally important and helpful to mitigate the attacks and to improve the quality of service (QoS) for normal users. In the current paper, a stochastic queue dynamic model withLe´vy jump noise, which is affected by the continuous Brownian motion and the discontinuous Poisson process, is worked out to develop a novel and accurate mathematical framework for the stability of a route queue that deals with constant-rate DDoS attacks. This article proposes a security defensive mechanism in the network for solving the network collapse that can possibly be caused by DDoS attacks, otherwise. Particularly, based on the formulation of a stochastic queue dynamic with Le´vy jump noise, the mechanism that characterizes the behavior of the queue at routers is presented for stabilizing the queue length under constant-rate DDoS attacks. By applying the stochastic control theory into analyzing the performance of queue dynamic under constant-rate DDoS attacks, some explicit conditions are established under which the instantaneous queue length converges to any given target in a route. Simulation results demonstrate the satisfaction of the proposed defense mechanism with sharp contrast to the state of the art active queue management (AQM) schemes.


---

## Body

## 1. Introduction

Distributed denial of service (DDoS) attackers send large volume of attacking packets through the distributed method, which subsequently prevent the normal users to access the Internet services and seriously affect the availability of the networks. The motivations of DDoS attacks range from commercial competition to extortion and even political motives. There are growing research interests on DDoS attacks, mainly including detecting DDoS attacks and mitigating DDoS attacks [1–3]. The biggest disadvantage of intrusion detection system (IDS), as a DDoS defense platform, is that IDS can only detect the attacks, but it does nothing to alleviate the attacks [4, 5]. Guarino et al. [6] presented a novel application of neural networks to classify DDoS attacks and used hive plot images for DDoS attack classification. The authors [7] apply the machine learning algorithm to differentiate attack and normal traffic in near-real-time and create Firewall rules to make distributed filtering come true. However, due to the static nature of these methods, there are some limitations to recognize the constantly changing DDoS attacks.Due to the lack of the reasonable modeling methods for DDoS attacks and an effective DDoS combat solution, the trend of size, frequency, and complexity of DDoS attacks still continues to increase. Due to the explosive growth of network traffic under DDoS attacks, the traditional systems are difficult to deal with DDoS attacks. Therefore, it is necessary to establish a targeted and effective mathematical model for research. Moreover, it is key to model the behavior of constant-rate DDoS attacks, explain mathematically the damage behavior of constant-rate DDoS attacks, and provide a theoretical basis for the defense strategy.


### 1.1. Related Work of Stochastic Dynamic Theory

Stochastic control theory has attracted many researchers’ attention and has become a hot research area due to its theoretical and practical significance. At present, stochastic nonlinear systems have been widely used in various fields such as population models, automatic control, and network models. Furthermore, the stability of stochastic nonlinear systems and other related theories have become important research directions. Mao and Yuan [8] conduct in-depth professional research on the stability (e.g., asymptotic stability and exponential stability) of stochastic nonlinear systems. Zong et al. [9] derive the transient and exponential stability criteria for Lyapunov functions on the basis of the functional Ito^ formula. Nguyen and Yin [10] obtained new conclusions for almost sure and Lp stability of SFDEs with regime switching by using Lyapunov functionals. Various discriminant conditions of stochastic systems are obtained by applying Lyapunov, stochastic inequality, stochastic differential equation, and so on. Stochastic control systems include parameter estimation, characteristics identification, state filtering, optimal disturbance rejection control, and other aspects [11]. Stochastic model and stochastic control theory have been well developed and widely studied in other applications (e.g., finance and signal processing), but they are rarely studied in the field of communication security.Stochastic dynamic models withLe´vy jump noise have been studied extensively [12–15]. In addition, potential applications of Le´vy jump noise models in communication engineering have attracted great attention among scholars. The results of relevant theories have become an indispensable part of many cutting-edge technologies, including aerospace technologies, automatic control, and network communications. Hu [16] proposed the stochastic linear quadratic optimal control problem and the optimal stop problem for finite time zone and infinite time zone driven by Le´vy process, which provides the theoretical basis. Complex dynamical systems are often affected by non-Gaussian Le´vy noise. Chen et al. [17] presented a nonlocal interaction differential equation that describes the average exit time of non-Gaussian discontinuous Le´vy jump noise systems.In order to better model the system,Le´vy noise is commonly found in finance [18], signal processing [19], secure communication system [20], and other fields [21] and has been successfully applied in many fields. There is growing evidence that stochastic processes with jumps more realistically describe the behavior of many dynamic models; for example, the load of vehicles can be described by a Poisson process [22]. Besides, the adaptive control of Le´vy jump noise systems and the adaptive control of systems’ parameter estimation are studied in the real networks. The literature [23] investigates the controllability of stochastic systems which are driven by Le´vy process and proposes some assumptions to obtain completely suitable controllability. Zhang et al. [24] presented the class of stochastic systems with Le´vy noise on networks and established some criterions to guarantee pth moment exponential stability and stability in probability by applying Lyapunov stability theory and graph theory. Huang and Wang [25] analyzed a quadratic stochastic control system which is driven by Le´vy process, verified the existence and uniqueness of explicit control, and obtained the explicit form of optimal control for this control system, therefore solving the quadratic stochastic optimal control problem. This phenomenon that the surge in network traffic is caused by DDoS attacks cannot be described by traditional white noise. Taking into account, Le´vy jump noise in a stochastic queue model makes the system analysis more realistic. Unfortunately, there are research gaps in the study of stochastic network dynamics with Le´vy jump noise in the field of network security, which deserves more attention. In this context, for constant-rate DDoS attacks problem, this paper introduces control technology to defense against constant-rate DDoS attacks.


### 1.2. Key Challenge and Contributions

In the Internet, stability of the instantaneous queue length in the relevant routes plays a very important role in the network performance such as high throughput; controlling instantaneous queue size is a key issue that network systems need to address. The variation of network parameters and instantaneous queue length is essentially in random [26] nature, which has not been adequately attended so far in the current expositions in this domain. When large amounts of malicious traffic inject packets into the routers, the inherent randomness of instantaneous queue can be observed to be particularly significant. Therefore, this paper proposes a stochastic differential equation approach with Le´vy jump noise (SDE-LJN). Other researchers improve network by building nonlinear controllers [27–29] which adjust controller parameters compatible with system dynamics and then affect system performance. In view of DDoS attack traffic, control theory is used to analyze SDE-LJN system under DDoS attacks and present a kind of so-called parabolic control strategy in the article. The network quality of service (QoS) can be improved by suppressing the attack traffic. Our defense mechanism makes instantaneous queue length in the router converge to a given target and effectively inhibits malicious traffic. We introduce Le´vy jump noise into the stochastic queue system, which aims to describe the great influence of constant-rate DDoS attacks and to understand the impact of constant-rate DDoS attacks on network queues. Thus, SDE-LJN model is established and an adaptive defend strategy is derived, which can help to establish an anti-DDoS attack mechanism to block malicious traffic and control outbreaks. Note that, a defense scheme based on SDE-LJN system provides critical insight and guidance into maintaining the desired queue length, resulting in robust performance for networks under constant-rate DDoS attacks. Simulation results indicate the feasibility of our defend strategy against constant-rate DDoS attacks.It is an important practical problem that is achieving stability of instantaneous queue length under DDoS attacks. According to the characteristics of constant-rate DDoS attacks, this paper establishes a novel accurate model and obtains the corresponding control feedback law, that is, this paper models and analyzes SDE-LJN system under constant-rate DDoS attacks, and then the suitable defend strategy is found to mitigate constant-rate DDoS attacks. The objective of SDE-LJN system is to make the instantaneous queue size converge to a target value. The parameters of SDE-LJN system and the control parameter are adjusted to mitigate the attack traffic. How to mitigate DDoS attacks by using a less conservative technique and how to effectively deal with DDoS attacks are extremely interesting and deserve our investigation. The major contributions of the paper are outlined as follows:(1)
The SDE-LJN model is established under constant-rate DDoS attacks. Some interesting conclusions are obtained to deal with DDoS attacks by applyingLe´vy jump noise as the disturbance factor to describe the evolutions of instantaneous queue when the networks suffer from DDoS attacks. Then, SDE-LJN system, an accurate model describing DDoS attacks, brings a new perspective for DDoS attacks defense.(2)
A new defend criterion is proposed to regulate instantaneous queue length to a desired target and thus to hold back malicious traffic rate.(3)
An important fact has been revealed that the suitable white noise can suppress the explosion of constant-rate DDoS attacks effectively.(4)
An anti-DDoS mechanism is designed to block malicious traffic to maintain the desired queue length and thereby to ensure normal transmission of legitimate traffic.


### 1.3. Paper Layout

The remainder of this paper is organized as follows. Section2 proposes and analyzes the stochastic queue model with Le´vy jump noise under DDoS attacks. Section 3 shows the stability analysis of the stochastic queue dynamic with Le´vy jump noise under DDoS attacks. In Section 4, simulation results verify our theoretical results and show the satisfaction of the proposed scheme. Finally, Section 5 concludes the paper and discusses future work.


## 1.1. Related Work of Stochastic Dynamic Theory

Stochastic control theory has attracted many researchers’ attention and has become a hot research area due to its theoretical and practical significance. At present, stochastic nonlinear systems have been widely used in various fields such as population models, automatic control, and network models. Furthermore, the stability of stochastic nonlinear systems and other related theories have become important research directions. Mao and Yuan [8] conduct in-depth professional research on the stability (e.g., asymptotic stability and exponential stability) of stochastic nonlinear systems. Zong et al. [9] derive the transient and exponential stability criteria for Lyapunov functions on the basis of the functional Ito^ formula. Nguyen and Yin [10] obtained new conclusions for almost sure and Lp stability of SFDEs with regime switching by using Lyapunov functionals. Various discriminant conditions of stochastic systems are obtained by applying Lyapunov, stochastic inequality, stochastic differential equation, and so on. Stochastic control systems include parameter estimation, characteristics identification, state filtering, optimal disturbance rejection control, and other aspects [11]. Stochastic model and stochastic control theory have been well developed and widely studied in other applications (e.g., finance and signal processing), but they are rarely studied in the field of communication security.Stochastic dynamic models withLe´vy jump noise have been studied extensively [12–15]. In addition, potential applications of Le´vy jump noise models in communication engineering have attracted great attention among scholars. The results of relevant theories have become an indispensable part of many cutting-edge technologies, including aerospace technologies, automatic control, and network communications. Hu [16] proposed the stochastic linear quadratic optimal control problem and the optimal stop problem for finite time zone and infinite time zone driven by Le´vy process, which provides the theoretical basis. Complex dynamical systems are often affected by non-Gaussian Le´vy noise. Chen et al. [17] presented a nonlocal interaction differential equation that describes the average exit time of non-Gaussian discontinuous Le´vy jump noise systems.In order to better model the system,Le´vy noise is commonly found in finance [18], signal processing [19], secure communication system [20], and other fields [21] and has been successfully applied in many fields. There is growing evidence that stochastic processes with jumps more realistically describe the behavior of many dynamic models; for example, the load of vehicles can be described by a Poisson process [22]. Besides, the adaptive control of Le´vy jump noise systems and the adaptive control of systems’ parameter estimation are studied in the real networks. The literature [23] investigates the controllability of stochastic systems which are driven by Le´vy process and proposes some assumptions to obtain completely suitable controllability. Zhang et al. [24] presented the class of stochastic systems with Le´vy noise on networks and established some criterions to guarantee pth moment exponential stability and stability in probability by applying Lyapunov stability theory and graph theory. Huang and Wang [25] analyzed a quadratic stochastic control system which is driven by Le´vy process, verified the existence and uniqueness of explicit control, and obtained the explicit form of optimal control for this control system, therefore solving the quadratic stochastic optimal control problem. This phenomenon that the surge in network traffic is caused by DDoS attacks cannot be described by traditional white noise. Taking into account, Le´vy jump noise in a stochastic queue model makes the system analysis more realistic. Unfortunately, there are research gaps in the study of stochastic network dynamics with Le´vy jump noise in the field of network security, which deserves more attention. In this context, for constant-rate DDoS attacks problem, this paper introduces control technology to defense against constant-rate DDoS attacks.


## 1.2. Key Challenge and Contributions

In the Internet, stability of the instantaneous queue length in the relevant routes plays a very important role in the network performance such as high throughput; controlling instantaneous queue size is a key issue that network systems need to address. The variation of network parameters and instantaneous queue length is essentially in random [26] nature, which has not been adequately attended so far in the current expositions in this domain. When large amounts of malicious traffic inject packets into the routers, the inherent randomness of instantaneous queue can be observed to be particularly significant. Therefore, this paper proposes a stochastic differential equation approach with Le´vy jump noise (SDE-LJN). Other researchers improve network by building nonlinear controllers [27–29] which adjust controller parameters compatible with system dynamics and then affect system performance. In view of DDoS attack traffic, control theory is used to analyze SDE-LJN system under DDoS attacks and present a kind of so-called parabolic control strategy in the article. The network quality of service (QoS) can be improved by suppressing the attack traffic. Our defense mechanism makes instantaneous queue length in the router converge to a given target and effectively inhibits malicious traffic. We introduce Le´vy jump noise into the stochastic queue system, which aims to describe the great influence of constant-rate DDoS attacks and to understand the impact of constant-rate DDoS attacks on network queues. Thus, SDE-LJN model is established and an adaptive defend strategy is derived, which can help to establish an anti-DDoS attack mechanism to block malicious traffic and control outbreaks. Note that, a defense scheme based on SDE-LJN system provides critical insight and guidance into maintaining the desired queue length, resulting in robust performance for networks under constant-rate DDoS attacks. Simulation results indicate the feasibility of our defend strategy against constant-rate DDoS attacks.It is an important practical problem that is achieving stability of instantaneous queue length under DDoS attacks. According to the characteristics of constant-rate DDoS attacks, this paper establishes a novel accurate model and obtains the corresponding control feedback law, that is, this paper models and analyzes SDE-LJN system under constant-rate DDoS attacks, and then the suitable defend strategy is found to mitigate constant-rate DDoS attacks. The objective of SDE-LJN system is to make the instantaneous queue size converge to a target value. The parameters of SDE-LJN system and the control parameter are adjusted to mitigate the attack traffic. How to mitigate DDoS attacks by using a less conservative technique and how to effectively deal with DDoS attacks are extremely interesting and deserve our investigation. The major contributions of the paper are outlined as follows:(1)
The SDE-LJN model is established under constant-rate DDoS attacks. Some interesting conclusions are obtained to deal with DDoS attacks by applyingLe´vy jump noise as the disturbance factor to describe the evolutions of instantaneous queue when the networks suffer from DDoS attacks. Then, SDE-LJN system, an accurate model describing DDoS attacks, brings a new perspective for DDoS attacks defense.(2)
A new defend criterion is proposed to regulate instantaneous queue length to a desired target and thus to hold back malicious traffic rate.(3)
An important fact has been revealed that the suitable white noise can suppress the explosion of constant-rate DDoS attacks effectively.(4)
An anti-DDoS mechanism is designed to block malicious traffic to maintain the desired queue length and thereby to ensure normal transmission of legitimate traffic.


## 1.3. Paper Layout

The remainder of this paper is organized as follows. Section2 proposes and analyzes the stochastic queue model with Le´vy jump noise under DDoS attacks. Section 3 shows the stability analysis of the stochastic queue dynamic with Le´vy jump noise under DDoS attacks. In Section 4, simulation results verify our theoretical results and show the satisfaction of the proposed scheme. Finally, Section 5 concludes the paper and discusses future work.


## 2. Mathematical Modeling of Queue Dynamic with Lévy Jump under Constant-Rate DDoS Attacks

To bring the instantaneous queue length to the desired target and to avoid overflow and serious fluctuations of instantaneous queue are considered to be the vital objectives [30–33]. The instantaneous queue size, to a certain extent, represents the state of networks at the moment and can estimate whether the network in normal or abnormal. Therefore, SDE-LJN system is proposed and the anti-DDoS mechanism is used to block DDoS attack flows into the victim networks.The sample path of the bottleneck queue size is described by the differential equation as follows [34]:(1)dqtdt=−C+NτtWt,where Tp represents propagation delay (seconds), τt=qt/C+Tp means the round-trip time, Wt, wherein 0≤Wt≤Wmax represents the congestion window size in packets, Wmax is the maximum window size, qt, wherein 0≤qt≤qmax is the queue size (packets), qmax is the maximum queue size, C is a single bottleneck transmission link of capacity, and N represents the number of connections. Equation (1) can be linearized around its equilibrium point w0,q0 to obtain(2)dδqtdt=1τ0NδWt−δqt,where δWt=Wt−W0,δqt=qt−q0 and τ0 represents the delay time at the equilibrium point of the system, which is the summation of the propagation delay and the queuing delay at the equilibrium point. That is, τ0=q0/C+Tp.


### 2.1. Attack Model

As depicted in Figure1 [35], Figure 1(a) is composed of a single bottleneck queue driven by DoS flows, and Figure 1(b) shows that the periodic l-length bursts create short l′-length outages. The incoming packets from the violators reach the queue, which results in reducing the congestion window for users.Figure 1
(a) Denial of service attacks scenario and (b) system model.If all users including normal users and perpetrators send a mixed streamqTCPt and qVt, then the associated rate of the congestion windows is(3)qTCPt+qVtIqVZ=Wtτt,where IqVZ is an indicator function in an attack packet set qV; the function value equals 1 if Z is true, 0 otherwise:(4)IqVZ=1,Z∈qV,there is DDoS attack;0,Z∉qV,no DDoS attack.When these attackers launch a DDoS attack, the network traffic increases significantly and does not attenuate during the attack, which is much higher than the normal network traffic value. Therefore, the total incoming rate of the congestion window can be used as a statistical feature of the network traffic, and attacks can be judged by comparing the current network state with the normal network state. Once the aggregation rate spikes significantly, the alarm will sound. However, some of the warnings may be false. Thus, once the warning is issued, the detection module will carry out attack detection on the suspicious traffic. The detector accurately detects DDoS attacks, and the isolator then correctly distinguishes attack traffic and legitimate traffic. This result is significant for applications in that, once the DDoS attack flows are discriminated from legitimate flows, one is able to block the attack packets from entering the queue [1].The equivalent form of (3) is(5)τtqTCPt+τtqVtIqVZ=Wt.According to the above description,δqt and δWt in the queue model (2) under DDoS attacks will be transformed as follows:(6)δqt=qTCPt+qVtIqVZ−q0TCP,(7)δWt=τtqTCPt+τtqVtIqVZ−W0TCP,(8)τ0=q0VIqVZ+q0TCPC+Tp.Assume that the instantaneous queue without a DDoS attack is under a stable initial state, whereW0TCP and q0TCP are the initial values in a steady state, which are fixed at equilibrium points without DDoS attacks. Taking DDoS attacks into consideration, equations (6)–(8) impose the effect of DDoS attacks on the network system dynamics. Starting from (3), all the equations contain the factor of DDoS attacks in our paper, and our discussions focus on the solution to handle the traffic under the DDoS attack.


### 2.2. System Model

The deterministic systems mean that network parameters in the models are all deterministic irrespective of stochastic fluctuations, from the points of real network view, which has some limitations in modeling and practical application of network dynamic models. White noise or Brownian motion is an ordinary model to describe disturbances, and network systems in real-world environment are affected inevitably by random noise. Therefore, considering stochastic perturbation into the sample path of the bottleneck queue size is necessary. We study a parametric class of stochastic processes to model instantaneous queue in our paper. As a result, (2) can be written as(9)dδqt=1τ0NδWt−δqtdt+ξdBt,where B˙t denotes a white noise and Bt represents a Brownian motion defined on a complete probability space Ω,Ϝ,ℙ with a filtration Ϝt≥0 satisfying the usual conditions (namely, it is right continuous and increasing while Ϝ0 contains all ℙ-null sets). ξ is the intensity of the noise process.In general, researchers regard white noise as random interference in stochastic systems. However, a drawback of white noise is not sufficient to describe the change of instantaneous disturbance. In addition to the continuous white noise, network systems may also be affected by discontinuous noise such asLe´vy jump noise. Interference from DDoS attack streams is discontinuous (see Figure 2). In general, this phenomenon can be described as a combination of stochastic differential equation of white noise and Le´vy jump noise mathematically. Networks may suffer from sudden and powerful DDoS attacks with devastating force. DDoS attacks disrupt the QoS of a host from the Internet and dramatically waste network resources of target users, thus resulting in QoS cliff drop. Unfortunately, stochastic equation (9) with white noise is not enough to explain this kind of sudden and explosive phenomenon. This kind of phenomenon is generally described by stochastic differential equations with Le´vy jump noise, which describes the dynamic behavior of system with the combination of continuous and jump noise disturbing factors.Figure 2
The constant-rate DDoS attack stream pattern.The DDoS attack strategy is the description of attack traffic at every time during the attack process. All DDoS attack strategies could be classified into three categories (i.e., varying-rate, constant-rate, and increasing-rate). The constant-rate DDoS attack differs from other DDoS attacks with the obvious feature that periodically sends a short-time high rate such as pulse. The constant-rate DDoS attack stream is created by the model given in Figure2 [36], where a is the attack period, u indicates the burst period, and ru means the burst rate. DDoS attackers inject TCP flows into the time-out (RTO) mechanisms by sending attack rate r(u); thus, the TCP throughput will be reduced. Mathematically, discontinuous Poisson process can depict the major unpredictable disaster events, thus it can describe this characteristic phenomenon caused by DDoS attacks.An accurate mathematical model is crucially important to study how to mitigate DDoS attacks. In order to explain the phenomenon of DDoS attacks,Le´vy jump noise was introduced into queue dynamics. DDoS attacks make the network traffic have high noise characteristics, so the stochastic model with Le´vy jump noise (SDE-LJN) is a reasonable and necessary way to describe networks under DDoS attacks and provides a feasible and more realistic model that directly reflects the dynamic characteristics, the dynamic variation of the parameters of SDE-LJN system and performance of instantaneous queue. Referring to the stochastic dynamic models with Le´vy noise, the novel SDE-LJN model is formulated to analyze the evolution of network states under attacks. Therefore, SDE-LJN system is established as follows:(10)dδqt=1τ0NδWt−δqtdt+ξdBt+δqt−∫YruN˜dt,du,where τ0 represents the delay time at the equilibrium point of the system under a DDoS attack. The function ru is called the jump term with jump size u. According to equation (10) and Figure 2, the jump term ru in equation (10) is equal to the attack rate ru in Figure 2; the jump size u in equation (10) is the same as the burst period u in Figure 2. Therefore, as can be seen from Figure 2, equation (10) describes the characteristics of constant-rate DDoS attack. In other words, SDE-LJN system well reflects the influence of constant-rate DDoS attack intensity on the system. The component δqt−=lims↑tδqs. N˜dt,du is a Poisson counting measure with characteristic measure λ on a measurable subset Y of 0,∞ with λY<∞, N˜dt,du:=Ndt,du−λdudt. Also, Ndt,du denotes an adapted compensated Poisson random measure with intensity measure λ in [37, 38]. Note that Bt and Ndt,du are independent.SDE-LJN system directly reflects the dynamic characteristics and transient performance of the queue under DDoS attacks. We advocate that the stochastic queue dynamic withLe´vy jump noise can greatly benefit to describe the dynamic of network under DDoS attacks and help us to develop more efficient design guidelines. Hence, in order to deal with the DDoS attack, it is significant and necessary to analyze the dynamic of SDE-LJN system.As explored later, this article gives the following reasonable hypotheses.Hypothesis 1.
Detecting the DDoS attack in the process of an attack can discriminate attack trafficqVt from legitimate traffic qTCPt, and qVt and qTCPt can be separated.Hypothesis 2.
Kwq<0 and δqt and ru are bounded functions; δqˇ:=supt∈ℝ+δqt and ru>−1,u∈Y, ∫Yru−ln1+ruλdu≥0.Hypothesis 3.
8τ02∫Yru−ln1+ruλdu≥ξ2+2τ0−1 and ξ2>1.Only when malicious flows can be differentiated from legitimate flows as stated in Hypothesis1, the attack flows can be controlled and blocked without affecting the normal flows in the mitigation phase. Hypotheses 2 and 3 are closely related to the parameters of networks and the disturbance intensity of white noise and Le´vy jump noise.


## 2.1. Attack Model

As depicted in Figure1 [35], Figure 1(a) is composed of a single bottleneck queue driven by DoS flows, and Figure 1(b) shows that the periodic l-length bursts create short l′-length outages. The incoming packets from the violators reach the queue, which results in reducing the congestion window for users.Figure 1
(a) Denial of service attacks scenario and (b) system model.If all users including normal users and perpetrators send a mixed streamqTCPt and qVt, then the associated rate of the congestion windows is(3)qTCPt+qVtIqVZ=Wtτt,where IqVZ is an indicator function in an attack packet set qV; the function value equals 1 if Z is true, 0 otherwise:(4)IqVZ=1,Z∈qV,there is DDoS attack;0,Z∉qV,no DDoS attack.When these attackers launch a DDoS attack, the network traffic increases significantly and does not attenuate during the attack, which is much higher than the normal network traffic value. Therefore, the total incoming rate of the congestion window can be used as a statistical feature of the network traffic, and attacks can be judged by comparing the current network state with the normal network state. Once the aggregation rate spikes significantly, the alarm will sound. However, some of the warnings may be false. Thus, once the warning is issued, the detection module will carry out attack detection on the suspicious traffic. The detector accurately detects DDoS attacks, and the isolator then correctly distinguishes attack traffic and legitimate traffic. This result is significant for applications in that, once the DDoS attack flows are discriminated from legitimate flows, one is able to block the attack packets from entering the queue [1].The equivalent form of (3) is(5)τtqTCPt+τtqVtIqVZ=Wt.According to the above description,δqt and δWt in the queue model (2) under DDoS attacks will be transformed as follows:(6)δqt=qTCPt+qVtIqVZ−q0TCP,(7)δWt=τtqTCPt+τtqVtIqVZ−W0TCP,(8)τ0=q0VIqVZ+q0TCPC+Tp.Assume that the instantaneous queue without a DDoS attack is under a stable initial state, whereW0TCP and q0TCP are the initial values in a steady state, which are fixed at equilibrium points without DDoS attacks. Taking DDoS attacks into consideration, equations (6)–(8) impose the effect of DDoS attacks on the network system dynamics. Starting from (3), all the equations contain the factor of DDoS attacks in our paper, and our discussions focus on the solution to handle the traffic under the DDoS attack.


## 2.2. System Model

The deterministic systems mean that network parameters in the models are all deterministic irrespective of stochastic fluctuations, from the points of real network view, which has some limitations in modeling and practical application of network dynamic models. White noise or Brownian motion is an ordinary model to describe disturbances, and network systems in real-world environment are affected inevitably by random noise. Therefore, considering stochastic perturbation into the sample path of the bottleneck queue size is necessary. We study a parametric class of stochastic processes to model instantaneous queue in our paper. As a result, (2) can be written as(9)dδqt=1τ0NδWt−δqtdt+ξdBt,where B˙t denotes a white noise and Bt represents a Brownian motion defined on a complete probability space Ω,Ϝ,ℙ with a filtration Ϝt≥0 satisfying the usual conditions (namely, it is right continuous and increasing while Ϝ0 contains all ℙ-null sets). ξ is the intensity of the noise process.In general, researchers regard white noise as random interference in stochastic systems. However, a drawback of white noise is not sufficient to describe the change of instantaneous disturbance. In addition to the continuous white noise, network systems may also be affected by discontinuous noise such asLe´vy jump noise. Interference from DDoS attack streams is discontinuous (see Figure 2). In general, this phenomenon can be described as a combination of stochastic differential equation of white noise and Le´vy jump noise mathematically. Networks may suffer from sudden and powerful DDoS attacks with devastating force. DDoS attacks disrupt the QoS of a host from the Internet and dramatically waste network resources of target users, thus resulting in QoS cliff drop. Unfortunately, stochastic equation (9) with white noise is not enough to explain this kind of sudden and explosive phenomenon. This kind of phenomenon is generally described by stochastic differential equations with Le´vy jump noise, which describes the dynamic behavior of system with the combination of continuous and jump noise disturbing factors.Figure 2
The constant-rate DDoS attack stream pattern.The DDoS attack strategy is the description of attack traffic at every time during the attack process. All DDoS attack strategies could be classified into three categories (i.e., varying-rate, constant-rate, and increasing-rate). The constant-rate DDoS attack differs from other DDoS attacks with the obvious feature that periodically sends a short-time high rate such as pulse. The constant-rate DDoS attack stream is created by the model given in Figure2 [36], where a is the attack period, u indicates the burst period, and ru means the burst rate. DDoS attackers inject TCP flows into the time-out (RTO) mechanisms by sending attack rate r(u); thus, the TCP throughput will be reduced. Mathematically, discontinuous Poisson process can depict the major unpredictable disaster events, thus it can describe this characteristic phenomenon caused by DDoS attacks.An accurate mathematical model is crucially important to study how to mitigate DDoS attacks. In order to explain the phenomenon of DDoS attacks,Le´vy jump noise was introduced into queue dynamics. DDoS attacks make the network traffic have high noise characteristics, so the stochastic model with Le´vy jump noise (SDE-LJN) is a reasonable and necessary way to describe networks under DDoS attacks and provides a feasible and more realistic model that directly reflects the dynamic characteristics, the dynamic variation of the parameters of SDE-LJN system and performance of instantaneous queue. Referring to the stochastic dynamic models with Le´vy noise, the novel SDE-LJN model is formulated to analyze the evolution of network states under attacks. Therefore, SDE-LJN system is established as follows:(10)dδqt=1τ0NδWt−δqtdt+ξdBt+δqt−∫YruN˜dt,du,where τ0 represents the delay time at the equilibrium point of the system under a DDoS attack. The function ru is called the jump term with jump size u. According to equation (10) and Figure 2, the jump term ru in equation (10) is equal to the attack rate ru in Figure 2; the jump size u in equation (10) is the same as the burst period u in Figure 2. Therefore, as can be seen from Figure 2, equation (10) describes the characteristics of constant-rate DDoS attack. In other words, SDE-LJN system well reflects the influence of constant-rate DDoS attack intensity on the system. The component δqt−=lims↑tδqs. N˜dt,du is a Poisson counting measure with characteristic measure λ on a measurable subset Y of 0,∞ with λY<∞, N˜dt,du:=Ndt,du−λdudt. Also, Ndt,du denotes an adapted compensated Poisson random measure with intensity measure λ in [37, 38]. Note that Bt and Ndt,du are independent.SDE-LJN system directly reflects the dynamic characteristics and transient performance of the queue under DDoS attacks. We advocate that the stochastic queue dynamic withLe´vy jump noise can greatly benefit to describe the dynamic of network under DDoS attacks and help us to develop more efficient design guidelines. Hence, in order to deal with the DDoS attack, it is significant and necessary to analyze the dynamic of SDE-LJN system.As explored later, this article gives the following reasonable hypotheses.Hypothesis 1.
Detecting the DDoS attack in the process of an attack can discriminate attack trafficqVt from legitimate traffic qTCPt, and qVt and qTCPt can be separated.Hypothesis 2.
Kwq<0 and δqt and ru are bounded functions; δqˇ:=supt∈ℝ+δqt and ru>−1,u∈Y, ∫Yru−ln1+ruλdu≥0.Hypothesis 3.
8τ02∫Yru−ln1+ruλdu≥ξ2+2τ0−1 and ξ2>1.Only when malicious flows can be differentiated from legitimate flows as stated in Hypothesis1, the attack flows can be controlled and blocked without affecting the normal flows in the mitigation phase. Hypotheses 2 and 3 are closely related to the parameters of networks and the disturbance intensity of white noise and Le´vy jump noise.


## 3. The Stability Analysis of the Stochastic Queue Dynamic with Lévy Jump under Constant-Rate DDoS Attacks

The stability analysis of networks queue model has caught many researchers’ attention [39–42]. However, DDoS attacks are the most main cause of network instability, divergence, and instantaneous queue oscillation. This section will discuss the stability of SDE-LJN system under constant-rate DDoS attacks.


### 3.1. The Control Analysis of SDE-LJN System under Constant-Rate DDoS Attacks

UsingIto^−Le´vy formula [43] to function lnδqt with respect to SDE-LJN system in (10), one has that(11)dlnδqt=1δqtτ0NδWt−δqt−ξ22δqt2τ02NδWt−δqt2+∫Yln1+ru−ruλdudt+ξδqtτ0NδWt−δqtdBt+∫Yln1+ruN˜dt,du.Integrating from 0 tot and then dividing by t on both sides of (11), one obtains(12)lnδqtt−lnq0TCPt=1t∫0t1δqtτ0NδWt−δqt−ξ22δqt2τ02NδWt−δqt2ds+∫Yln1+ru−rudu+1t∫0tξδqtτ0NδWt−δqtdBs+1t∫0t∫Yln1+ruN˜ds,du≤1t∫0t1δqtτ0ξ2τ0+1NδWt−δqt−ξ22τ02ds+∫Yln1+ru−ruλdu+1t∫0tξδqtτ0NδWt−δqtdBs+1t∫0t∫Yln1+ruN˜ds,du.In order to solve the challenge of DDoS attacks, we study the random queue system withLe´vy jump noise and design the parabolic controller as a defense mechanism against DDoS attacks (see Figure 3). The parabolic controller is introduced into SDE-LJN system to improve the practical applicability and anti-interference performance of the system. The purpose of the defense scheme based on SDE-LJN mathematical modeling is to return the network to a steady state when the DDoS attacks occur.Figure 3
Block diagram of SDE-LJN system under DDoS attack.Based on the above analysis, now we consider a novel control strategy for the SDE-LJN system and utilize the parabola equation as feedback control criteria:(13)δWt=Kwqδqt2,where Kwq is a control parameter which dynamically adjusts the congestion window size based on the current level of the network. The controller itself emits a signal, which can be used to drive the SDE-LJN system state equation (10) directly. As is seen in Figure 3, as δqt is a sampled signal input, one is able to compute the output signal δWt as a feedback signal. Taking parabolic controller (13) into account in the internal structure of SDE-LJN system, then parabolic controller (13) as feedback controller is integrated into the networks, forming a coupling structure with SDE-LJN system. Furthermore, parabolic controller (13) makes the SDE-LJN system (10) become a closed-loop system. Once a DDoS attack is found, the value of Kwq is adjusted to less than 0, then mitigation modules can be set off and block the DDoS attack stream, so as to avoid the network congestion and even breakdown. It is worth noting that only if Kwq<0, then one has δWt<0, which means that the congestion window size is decreasing under DDoS attacks and is consistent with the actual situation. Thus, the combination of SDE-LJN system (10) and parabolic controller (13) forms the mitigation mechanism.The stochastic queue dynamic withLe´vy jump noise takes the feedback control law (13) into consideration; substituting (13) into (12), one has(14)lnδqtt−lnq0TCPt≤1t∫0t1τ0ξ2τ0+1NKwqδqt−1−ξ22τ02ds+∫Yln1+ru−ruλdu+1t∫0tξτ0NKwqδqt−1dBs+1t∫0t∫Yln1+ruN˜ds,du=1t∫0t1τ0ξ2τ0+1NKwqδqt−1−ξ22τ02ds+∫Yln1+ru−ruλdu+Φtt+Φ˜tt,where Φt=∫0tξ/τ0NKwqδqt−1dBs and Φ˜t=∫0t∫Yln1+ruN˜ds,du are both local martingales. The quadratic variation processes of Φt and Φ˜t are(15)Φ,Φt=∫0tξ2τ02NKwqδqt−12ds,Φ˜,Φ˜t=∫0t∫Yln1+ru2λduds=t∫Yln1+ru2λdu,respectively.By (15), one obtains that(16)limsupt⟶∞Φ,Φt≤tξ2τ02NKwqδqˇ−12<∞,a.s.,limt⟶∞Φ˜,Φ˜t=∞,a.s.,therefore, in the light of strong law of large numbers for local martingales [44], yielding(17)limt⟶∞Φtt=0,a.s.,limt⟶∞Φ˜tt=0,a.s..Moreover, by Theorem 4.4 in [45], one has that the limit(18)limt⟶∞lnδqtt=0.Using Hypothesis2, namely, Kwq<0 and ∫Yru−ln1+ruλdu≥0, and taking the limit on both sides of (14), due to (17) and (18), one can conclude that(19)limt⟶∞1t∫0tδqtds≤ξ2/2τ0+τ0∫Yru−ln1+ruλdu+1ξ2/τ0+1NKwq≤0.Moreover, using the basic inequalityab≤a+b/22a,b∈R, one can calculate that(20)lnδqtt−lnq0TCPt=1t∫0tNKwqδqt−1ξ2+2τ0−ξ2NKwqδqt2τ02ds+∫Yln1+ru−ruλdu+1t∫0tξτ0Nδqt−1dBs+1t∫0t∫Yln1+ruN˜ds,du≤1t∫0t1−ξ2NKwqδqt+ξ2+2τ0−128τ02ds+∫Yln1+ru−ruλdu+1t∫0tξτ0Nδqt−1dBs+1t∫0t∫Yln1+ruN˜ds,du=1t∫0t1−ξ2NKwqδqt+ξ2+2τ0−128τ02ds+∫Yln1+ru−ruλdu+Φtt+Φ˜tt.Taking the limit on both sides of (20), due to (17) and (18), one can conclude that(21)8τ02∫Yru−ln1+ruλdu≤limt⟶∞1t∫0t1−ξ2NKwqδqt+ξ2+2τ0−12ds.According toHypotheses 2 and 3, namely, Kwq<0, ξ2>1, ∫Yru−ln1+ruλdu≥0, and 8τ02∫Yru−ln1+ruλdu≥ξ2+2τ0−1, leading to(22)limt⟶∞1t∫0tδqtds≥8τ02∫Yru−ln1+ruλdu−ξ2−2τ0+11−ξ2NKwq≥0.Finally, from (19) and (22), according to the squeeze theorem, one then derives that(23)limt⟶∞∫0tδqtds=0,namely,(24)limt⟶∞δqt=0.Substituting (6) into (22), consequently,(25)limt⟶∞qTCPt+qVt=q0TCP.Equation (25) indicates that the instantaneous queue length under DDoS attacks can converge to any given initial value q0TCP, where q0TCP is a fixed equilibrium point without DDoS attacks; one then has(26)limt⟶∞qTCPt=q0TCP.Combining (23) and (26), then we have(27)limt⟶∞qVt=0.Equation (27) implies that malicious packets tend to 0 and indicates that our defense technology is effective in blocking DDoS attacks based on Hypotheses 1, 2, and 3.


### 3.2. The Proposed Collaborative Architectures of Network Defense Deployment

The attacks defense system, the process of successfully protecting a victim network from attacks, can be widely composed of four modules: prevention, detection, mitigation, and analysis [46]. In this paper, the mitigation phase carries out the task based on Hypothesis 1, therefore the accuracy of discriminating attack traffic from legitimate traffic is required to be very high. Luckily, the current relevant research results and technologies have been able to achieve a very high degree of detection and classification. Many literatures have studied the detection of DDoS attacks and obtained high detection rate. Hoque et al. [47] used a novel correlation measure to detect DDoS attacks; further, field programmable gate arrays (FPGA) devices classify an incoming traffic as attack traffic or normal traffic in real-time. Alsirhani et al. [48] proposed a dynamic DDoS attack detection system composed of three components: a set of classification algorithms, a distributed system, and a fuzzy logic system. Classification algorithms are used to identify DDoS attacks, a distributed system (i.e., Apache Spark) accelerates the enforcement of these classification algorithms, and the fuzzy logic could dynamically select the right classification algorithm from a set of classification algorithms to detect DDoS attacks. Nandi et al. [49] applied the hybrid feature selection method to select the most important features and used various machine learning classifiers to detect and classify the attack packets and normal packets, then achieving the satisfactory detection rate.We expound the operation of the proposed defense deployment. The proposed collaborative deployment framework of defense DDoS attacks (please see Figure4) consists of two main modules: network attack detection module and network attack mitigation module. The detection module is responsible for analyzing the traffic characteristics and classifying them as normal or malicious traffic. The mitigation module then is accountable for blocking malicious traffic into networks. Our defense strategy has a complementary defense solution, which provides the combination of detection attack and the execution of mitigation attack. Therefore, how to effectively mitigate the attack is particularly important when the attack is detected, and this paper focuses on the research of mitigating DDoS attacks. Note that SDE-LJN system with the parabola feedback controller is used as the defense mechanism.Figure 4
A collaborative defense framework.


### 3.3. Technical Note

The white noise andLe´vy jump noise are introduced into a new stochastic queue model and the parabolic feedback controller then is proposed for this queue model. In order to solve or mitigate DDoS attacks, it is necessary to use the control mode and apply control valves to block malicious flows in real-time. Now, consider the relationship between the white noise factor ξ2 and the attack rate ru which conforms to the constraint of inequalities (17) and (20). The relationship between ξ2 and ru under a set of values of λY and τ0 is plotted in Figure 5, where Y=0,+∞, λY=1, τ0=0.25. As shown in Figure 5, the white noise factor ξ2 can be adjusted dynamically to tune the attack rate ru so that the optimal value of ξ2 makes the attack rate ru minimum. Figure 5 intuitively reveals an important fact that the suitable white noise can suppress the explosion of constant-rate DDoS attacks effectively. The standard method of calculating the minimum value of the attack rate ru requires on2 time.Figure 5
Relationship betweenξ2 and ru when Y=0,+∞, λY=1, τ0=0.25.The specific relationship of the white noise factorξ2, the attack rate ru, and the network parameter τ0 of SDE-LJN system can be taken as DDoS attacks’ defense strategy to achieve the purpose of protecting the networks. That is to say that the attack flows are unable to enter the routers of the victim networks (i.e., qVt⟶0) by adjusting the parameters of SDE-LJN system. The disadvantage is that the network parameter τ0, white noise parameter ξ2, and attack rate ru influence each other. Although these parameters are coupled, it is worthwhile to solve DDoS attacks.The defense strategy objectives of SDE-LJN system are(i)
Effectively controlling and blocking the attack flows into the network(ii)
Minimizing the attack traffic as much as possible, so that DDoS attacks do not make the network collapse


## 3.1. The Control Analysis of SDE-LJN System under Constant-Rate DDoS Attacks

UsingIto^−Le´vy formula [43] to function lnδqt with respect to SDE-LJN system in (10), one has that(11)dlnδqt=1δqtτ0NδWt−δqt−ξ22δqt2τ02NδWt−δqt2+∫Yln1+ru−ruλdudt+ξδqtτ0NδWt−δqtdBt+∫Yln1+ruN˜dt,du.Integrating from 0 tot and then dividing by t on both sides of (11), one obtains(12)lnδqtt−lnq0TCPt=1t∫0t1δqtτ0NδWt−δqt−ξ22δqt2τ02NδWt−δqt2ds+∫Yln1+ru−rudu+1t∫0tξδqtτ0NδWt−δqtdBs+1t∫0t∫Yln1+ruN˜ds,du≤1t∫0t1δqtτ0ξ2τ0+1NδWt−δqt−ξ22τ02ds+∫Yln1+ru−ruλdu+1t∫0tξδqtτ0NδWt−δqtdBs+1t∫0t∫Yln1+ruN˜ds,du.In order to solve the challenge of DDoS attacks, we study the random queue system withLe´vy jump noise and design the parabolic controller as a defense mechanism against DDoS attacks (see Figure 3). The parabolic controller is introduced into SDE-LJN system to improve the practical applicability and anti-interference performance of the system. The purpose of the defense scheme based on SDE-LJN mathematical modeling is to return the network to a steady state when the DDoS attacks occur.Figure 3
Block diagram of SDE-LJN system under DDoS attack.Based on the above analysis, now we consider a novel control strategy for the SDE-LJN system and utilize the parabola equation as feedback control criteria:(13)δWt=Kwqδqt2,where Kwq is a control parameter which dynamically adjusts the congestion window size based on the current level of the network. The controller itself emits a signal, which can be used to drive the SDE-LJN system state equation (10) directly. As is seen in Figure 3, as δqt is a sampled signal input, one is able to compute the output signal δWt as a feedback signal. Taking parabolic controller (13) into account in the internal structure of SDE-LJN system, then parabolic controller (13) as feedback controller is integrated into the networks, forming a coupling structure with SDE-LJN system. Furthermore, parabolic controller (13) makes the SDE-LJN system (10) become a closed-loop system. Once a DDoS attack is found, the value of Kwq is adjusted to less than 0, then mitigation modules can be set off and block the DDoS attack stream, so as to avoid the network congestion and even breakdown. It is worth noting that only if Kwq<0, then one has δWt<0, which means that the congestion window size is decreasing under DDoS attacks and is consistent with the actual situation. Thus, the combination of SDE-LJN system (10) and parabolic controller (13) forms the mitigation mechanism.The stochastic queue dynamic withLe´vy jump noise takes the feedback control law (13) into consideration; substituting (13) into (12), one has(14)lnδqtt−lnq0TCPt≤1t∫0t1τ0ξ2τ0+1NKwqδqt−1−ξ22τ02ds+∫Yln1+ru−ruλdu+1t∫0tξτ0NKwqδqt−1dBs+1t∫0t∫Yln1+ruN˜ds,du=1t∫0t1τ0ξ2τ0+1NKwqδqt−1−ξ22τ02ds+∫Yln1+ru−ruλdu+Φtt+Φ˜tt,where Φt=∫0tξ/τ0NKwqδqt−1dBs and Φ˜t=∫0t∫Yln1+ruN˜ds,du are both local martingales. The quadratic variation processes of Φt and Φ˜t are(15)Φ,Φt=∫0tξ2τ02NKwqδqt−12ds,Φ˜,Φ˜t=∫0t∫Yln1+ru2λduds=t∫Yln1+ru2λdu,respectively.By (15), one obtains that(16)limsupt⟶∞Φ,Φt≤tξ2τ02NKwqδqˇ−12<∞,a.s.,limt⟶∞Φ˜,Φ˜t=∞,a.s.,therefore, in the light of strong law of large numbers for local martingales [44], yielding(17)limt⟶∞Φtt=0,a.s.,limt⟶∞Φ˜tt=0,a.s..Moreover, by Theorem 4.4 in [45], one has that the limit(18)limt⟶∞lnδqtt=0.Using Hypothesis2, namely, Kwq<0 and ∫Yru−ln1+ruλdu≥0, and taking the limit on both sides of (14), due to (17) and (18), one can conclude that(19)limt⟶∞1t∫0tδqtds≤ξ2/2τ0+τ0∫Yru−ln1+ruλdu+1ξ2/τ0+1NKwq≤0.Moreover, using the basic inequalityab≤a+b/22a,b∈R, one can calculate that(20)lnδqtt−lnq0TCPt=1t∫0tNKwqδqt−1ξ2+2τ0−ξ2NKwqδqt2τ02ds+∫Yln1+ru−ruλdu+1t∫0tξτ0Nδqt−1dBs+1t∫0t∫Yln1+ruN˜ds,du≤1t∫0t1−ξ2NKwqδqt+ξ2+2τ0−128τ02ds+∫Yln1+ru−ruλdu+1t∫0tξτ0Nδqt−1dBs+1t∫0t∫Yln1+ruN˜ds,du=1t∫0t1−ξ2NKwqδqt+ξ2+2τ0−128τ02ds+∫Yln1+ru−ruλdu+Φtt+Φ˜tt.Taking the limit on both sides of (20), due to (17) and (18), one can conclude that(21)8τ02∫Yru−ln1+ruλdu≤limt⟶∞1t∫0t1−ξ2NKwqδqt+ξ2+2τ0−12ds.According toHypotheses 2 and 3, namely, Kwq<0, ξ2>1, ∫Yru−ln1+ruλdu≥0, and 8τ02∫Yru−ln1+ruλdu≥ξ2+2τ0−1, leading to(22)limt⟶∞1t∫0tδqtds≥8τ02∫Yru−ln1+ruλdu−ξ2−2τ0+11−ξ2NKwq≥0.Finally, from (19) and (22), according to the squeeze theorem, one then derives that(23)limt⟶∞∫0tδqtds=0,namely,(24)limt⟶∞δqt=0.Substituting (6) into (22), consequently,(25)limt⟶∞qTCPt+qVt=q0TCP.Equation (25) indicates that the instantaneous queue length under DDoS attacks can converge to any given initial value q0TCP, where q0TCP is a fixed equilibrium point without DDoS attacks; one then has(26)limt⟶∞qTCPt=q0TCP.Combining (23) and (26), then we have(27)limt⟶∞qVt=0.Equation (27) implies that malicious packets tend to 0 and indicates that our defense technology is effective in blocking DDoS attacks based on Hypotheses 1, 2, and 3.


## 3.2. The Proposed Collaborative Architectures of Network Defense Deployment

The attacks defense system, the process of successfully protecting a victim network from attacks, can be widely composed of four modules: prevention, detection, mitigation, and analysis [46]. In this paper, the mitigation phase carries out the task based on Hypothesis 1, therefore the accuracy of discriminating attack traffic from legitimate traffic is required to be very high. Luckily, the current relevant research results and technologies have been able to achieve a very high degree of detection and classification. Many literatures have studied the detection of DDoS attacks and obtained high detection rate. Hoque et al. [47] used a novel correlation measure to detect DDoS attacks; further, field programmable gate arrays (FPGA) devices classify an incoming traffic as attack traffic or normal traffic in real-time. Alsirhani et al. [48] proposed a dynamic DDoS attack detection system composed of three components: a set of classification algorithms, a distributed system, and a fuzzy logic system. Classification algorithms are used to identify DDoS attacks, a distributed system (i.e., Apache Spark) accelerates the enforcement of these classification algorithms, and the fuzzy logic could dynamically select the right classification algorithm from a set of classification algorithms to detect DDoS attacks. Nandi et al. [49] applied the hybrid feature selection method to select the most important features and used various machine learning classifiers to detect and classify the attack packets and normal packets, then achieving the satisfactory detection rate.We expound the operation of the proposed defense deployment. The proposed collaborative deployment framework of defense DDoS attacks (please see Figure4) consists of two main modules: network attack detection module and network attack mitigation module. The detection module is responsible for analyzing the traffic characteristics and classifying them as normal or malicious traffic. The mitigation module then is accountable for blocking malicious traffic into networks. Our defense strategy has a complementary defense solution, which provides the combination of detection attack and the execution of mitigation attack. Therefore, how to effectively mitigate the attack is particularly important when the attack is detected, and this paper focuses on the research of mitigating DDoS attacks. Note that SDE-LJN system with the parabola feedback controller is used as the defense mechanism.Figure 4
A collaborative defense framework.


## 3.3. Technical Note

The white noise andLe´vy jump noise are introduced into a new stochastic queue model and the parabolic feedback controller then is proposed for this queue model. In order to solve or mitigate DDoS attacks, it is necessary to use the control mode and apply control valves to block malicious flows in real-time. Now, consider the relationship between the white noise factor ξ2 and the attack rate ru which conforms to the constraint of inequalities (17) and (20). The relationship between ξ2 and ru under a set of values of λY and τ0 is plotted in Figure 5, where Y=0,+∞, λY=1, τ0=0.25. As shown in Figure 5, the white noise factor ξ2 can be adjusted dynamically to tune the attack rate ru so that the optimal value of ξ2 makes the attack rate ru minimum. Figure 5 intuitively reveals an important fact that the suitable white noise can suppress the explosion of constant-rate DDoS attacks effectively. The standard method of calculating the minimum value of the attack rate ru requires on2 time.Figure 5
Relationship betweenξ2 and ru when Y=0,+∞, λY=1, τ0=0.25.The specific relationship of the white noise factorξ2, the attack rate ru, and the network parameter τ0 of SDE-LJN system can be taken as DDoS attacks’ defense strategy to achieve the purpose of protecting the networks. That is to say that the attack flows are unable to enter the routers of the victim networks (i.e., qVt⟶0) by adjusting the parameters of SDE-LJN system. The disadvantage is that the network parameter τ0, white noise parameter ξ2, and attack rate ru influence each other. Although these parameters are coupled, it is worthwhile to solve DDoS attacks.The defense strategy objectives of SDE-LJN system are(i)
Effectively controlling and blocking the attack flows into the network(ii)
Minimizing the attack traffic as much as possible, so that DDoS attacks do not make the network collapse


## 4. Simulation Results

Verifying the effectiveness of alleviating the DDoS attacks is a challenging task. The stability of instantaneous queue under DDoS attacks means the effectiveness of alleviating DDoS attacks. We use ns2 simulator [50] to simulate and evaluate the performance of the instantaneous queue under the DDoS attack. In addition, we also simulate and test the throughput performance metric of ordinary users. The experimentation network environment setup is shown in Figure 6.Figure 6
The ns2 simulation environment.In our experiment, we simulate a single bottleneck link with a capacity of15Mbps. The maximum buffer size is set to 15,000 packets. The round-trip time is set to 0.25s and the target queue size q0 is set to 1,450 packets. The ordinary users and malicious attackers both send their packets consecutively within 100 seconds. Attack period a and attack burst u are set to be 1 s and 0.5 s, respectively.In order to simply distinguish ordinary users from malicious attackers and intuitively evaluate the performance of ordinary users, let ordinary users transmit TCP-based traffic and malicious attackers send UDP garbage packets.(i)
Normal flows: TCP flows of normal users are created by 100 TCP/Reno sources. The TCP-based traffic is transmitted with the rate of 1 kbps.(ii)
Malicious flows: the primary purpose of attackers is to prevent normal packets from arriving at the destination, rather than to ensure the delivery of malicious packets [51]. Malicious traffic is generated by sending attack packets and interfering with the normal communication. The UDP-based traffic as the attack traffic is created by 50 attack sources. The attack rate is 50 Mbps. Tens of thousands packets overwhelm the network in a short time, and the DDoS flows then consume the network resources.


### 4.1. Experiment 1: Comparison of Four Circumstances

The parameters of experiment 1 are implemented under 4 circumstances as follows:(i)
Circumstance I: the configuration parametersKwq=0.45>0, ξ2=1.21, and Y=0,+∞, λY=1, ru=30.15, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈3.6545≥ξ2+2τ0−1=0.7100 and ∫Yru−ln1+ruλdu=26.7112.(ii)
Circumstance II: the configuration parametersKwq=−0.0001, ξ2=0.93<1, and Y=0,+∞, λY=1, ru=30.15, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈3.6545≥ξ2+2τ0−1=0.4300 and ∫Yru−ln1+ruλdu=26.7112.(iii)
Circumstance III: the configuration parametersKwq=−0.0001, ξ2=1.21, and Y=0,+∞, λY=1, ru=0.05, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈0.0246≤ξ2+2τ0−1=0.7100 and ∫Yru−ln1+ruλdu=0.00121.(iv)
Circumstance IV: the configuration parametersKwq=−0.0001, ξ2=1.21, and Y=0,+∞, λY=1, ru=30.15, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈3.6545≥ξ2+2τ0−1=0.7100 and ∫Yru−ln1+ruλdu=26.7112.The configuration parameters of Circumstance I, Circumstance II, and Circumstance III all do not satisfy SDE-LJN scheme. However, the configuration parameters of Circumstance IV are suitable for the conditions of SDE-LJN system.


#### 4.1.1. Instantaneous Queue under DDoS Attacks in Experiment 1

Figures7–10 depict the instantaneous queue of four circumstances under the DDoS attack, respectively. Figures 7–9 show that the instantaneous queue sizes of Circumstance I, Circumstance II, and Circumstance III have serious oscillations and severe fluctuations under the attacks. However, in Figure 10, the instantaneous queue length fluctuates around the given target with acceptable oscillations under the attacks. Therefore, adjusting the queue length at the target is well done by using our proposed SDE-LJN scheme.Figure 7
The instantaneous queue length under Circumstance I.Figure 8
The instantaneous queue length under Circumstance II.Figure 9
The instantaneous queue length under Circumstance III.Figure 10
The instantaneous queue length under Circumstance IV.


#### 4.1.2. Throughput under DDoS Attacks in Experiment 1

Figure11 shows the comparison of TCP throughput of four circumstances under the DDoS attack, and Figure 11 indicates that the TCP throughput of Circumstance I, Circumstance II, and Circumstance III has a terrible consequence, respectively, but the TCP throughput of Circumstance IV achieves high throughput under the attacks.Figure 11
Comparison of TCP throughput of four circumstances under the DDoS attack.


### 4.2. Experiment 2: Comparison of Three Schemes

The parameters of experiment 2 are implemented under 3 schemes as follows:(i)
Drop-tail: use ns2 defaults.(ii)
RED: the configuration parameters of RED scheme [52] minth=200,maxth=1000wq=0.006.(iii)
SDE-LJN: the configuration parametersKwq=−0.0001, ξ2=1.21, and Y=0,+∞, λY=1, ru=−0.983, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈1.2433≥ξ2+2τ0−1=0.7100 and ∫Yru−ln1+ruλdu=3.0915.


#### 4.2.1. Instantaneous Queue under DDoS Attacks in Experiment 2

Figures12–14 display the instantaneous queue for three schemes (i.e., Drop-tail, RED, and SDE-LJN) under the DDoS attack, respectively. From Figures 12 and 13, it is observed that Drop-tail scheme and RED scheme cause the instantaneous queue length serious oscillations and have severe fluctuations of queue length under the attacks. Drop-tail and RED schemes have terrible outcomes because they are not designed to struggle against the attacks. However, Figure 14 indicates that the instantaneous queue length fluctuates around the target with small oscillations under the attacks.Figure 12
The instantaneous queue length under Drop-tail scheme.Figure 13
The instantaneous queue length under RED scheme.Figure 14
The instantaneous queue length under SDE-LJN scheme.


#### 4.2.2. TCP Throughput under DDoS Attacks in Experiment 2

Figure15 demonstrates the comparison of TCP throughput of three schemes (i.e., Drop-tail, RED, and SDE-LJN) under the DDoS attack. The CPU utilization at the router affects the throughput, so the throughput could be an indirect reflection of router CPU utilization. We can see from Figure 15 that the normal users’ throughput of two schemes (i.e., Drop-tail and RED) under the DDoS attack is unsatisfactory, since these schemes cannot mitigate the attack traffic, resulting in high CPU utilization at the router, or even overload. Compared with Drop-tail and RED schemes, the TCP throughput of SDE-LJN scheme is persistently satisfactory under the attacks. The high throughput of normal users under SDE-LJN scheme could indirectly indicate that the CPU utilization at the router is reasonable. Our proposed SDE-LJN scheme is more superior to mitigate DDoS attacks and improve the performance of networks than existing queue policy algorithms (herein refer to Drop-tail and RED).Figure 15
Comparison of TCP throughput of Drop-tail, RED, and SDE-LJN under the DDoS attack.Based on the comparison of experiment 1 and experiment 2 above, the simulation results verify the effectiveness of the proposed SDE-LJN system as defense scheme to mitigate DDoS attacks. In order to more clearly demonstrate this fact, we calculate the mean and standard deviation of the instantaneous queue size. Tables1 and 2 show that SDE-LJN scheme can achieve the mean queue length closest to the given target and the minimal standard deviation of the instantaneous queue length. Moreover, the results show that the proposed SDE-LJN scheme succeeds in improving the user’s experience (i.e., throughput).Table 1
Comparison of mean and standard deviation of instantaneous queue in experiment 1.
MeanStandard deviationCircumstance I6.0182e + 034.2677e + 03Circumstance II5.8253e + 035.2641e + 03Circumstance III6.3045e + 035.2491e + 03Circumstance IV1.4649e + 03259.6918Table 2
Comparison of mean and standard deviation of instantaneous queue in experiment 2.
MeanStandard deviationDrop-tail4.0150e + 034.7520e + 03RED4.2051e + 033.0884e + 03SDE-LJN1.4362e + 03524.7265


## 4.1. Experiment 1: Comparison of Four Circumstances

The parameters of experiment 1 are implemented under 4 circumstances as follows:(i)
Circumstance I: the configuration parametersKwq=0.45>0, ξ2=1.21, and Y=0,+∞, λY=1, ru=30.15, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈3.6545≥ξ2+2τ0−1=0.7100 and ∫Yru−ln1+ruλdu=26.7112.(ii)
Circumstance II: the configuration parametersKwq=−0.0001, ξ2=0.93<1, and Y=0,+∞, λY=1, ru=30.15, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈3.6545≥ξ2+2τ0−1=0.4300 and ∫Yru−ln1+ruλdu=26.7112.(iii)
Circumstance III: the configuration parametersKwq=−0.0001, ξ2=1.21, and Y=0,+∞, λY=1, ru=0.05, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈0.0246≤ξ2+2τ0−1=0.7100 and ∫Yru−ln1+ruλdu=0.00121.(iv)
Circumstance IV: the configuration parametersKwq=−0.0001, ξ2=1.21, and Y=0,+∞, λY=1, ru=30.15, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈3.6545≥ξ2+2τ0−1=0.7100 and ∫Yru−ln1+ruλdu=26.7112.The configuration parameters of Circumstance I, Circumstance II, and Circumstance III all do not satisfy SDE-LJN scheme. However, the configuration parameters of Circumstance IV are suitable for the conditions of SDE-LJN system.


### 4.1.1. Instantaneous Queue under DDoS Attacks in Experiment 1

Figures7–10 depict the instantaneous queue of four circumstances under the DDoS attack, respectively. Figures 7–9 show that the instantaneous queue sizes of Circumstance I, Circumstance II, and Circumstance III have serious oscillations and severe fluctuations under the attacks. However, in Figure 10, the instantaneous queue length fluctuates around the given target with acceptable oscillations under the attacks. Therefore, adjusting the queue length at the target is well done by using our proposed SDE-LJN scheme.Figure 7
The instantaneous queue length under Circumstance I.Figure 8
The instantaneous queue length under Circumstance II.Figure 9
The instantaneous queue length under Circumstance III.Figure 10
The instantaneous queue length under Circumstance IV.


### 4.1.2. Throughput under DDoS Attacks in Experiment 1

Figure11 shows the comparison of TCP throughput of four circumstances under the DDoS attack, and Figure 11 indicates that the TCP throughput of Circumstance I, Circumstance II, and Circumstance III has a terrible consequence, respectively, but the TCP throughput of Circumstance IV achieves high throughput under the attacks.Figure 11
Comparison of TCP throughput of four circumstances under the DDoS attack.


## 4.1.1. Instantaneous Queue under DDoS Attacks in Experiment 1

Figures7–10 depict the instantaneous queue of four circumstances under the DDoS attack, respectively. Figures 7–9 show that the instantaneous queue sizes of Circumstance I, Circumstance II, and Circumstance III have serious oscillations and severe fluctuations under the attacks. However, in Figure 10, the instantaneous queue length fluctuates around the given target with acceptable oscillations under the attacks. Therefore, adjusting the queue length at the target is well done by using our proposed SDE-LJN scheme.Figure 7
The instantaneous queue length under Circumstance I.Figure 8
The instantaneous queue length under Circumstance II.Figure 9
The instantaneous queue length under Circumstance III.Figure 10
The instantaneous queue length under Circumstance IV.


## 4.1.2. Throughput under DDoS Attacks in Experiment 1

Figure11 shows the comparison of TCP throughput of four circumstances under the DDoS attack, and Figure 11 indicates that the TCP throughput of Circumstance I, Circumstance II, and Circumstance III has a terrible consequence, respectively, but the TCP throughput of Circumstance IV achieves high throughput under the attacks.Figure 11
Comparison of TCP throughput of four circumstances under the DDoS attack.


## 4.2. Experiment 2: Comparison of Three Schemes

The parameters of experiment 2 are implemented under 3 schemes as follows:(i)
Drop-tail: use ns2 defaults.(ii)
RED: the configuration parameters of RED scheme [52] minth=200,maxth=1000wq=0.006.(iii)
SDE-LJN: the configuration parametersKwq=−0.0001, ξ2=1.21, and Y=0,+∞, λY=1, ru=−0.983, τ0=0.25; one then obtains by calculation 8τ02∫Yru−ln1+ruλdu≈1.2433≥ξ2+2τ0−1=0.7100 and ∫Yru−ln1+ruλdu=3.0915.


### 4.2.1. Instantaneous Queue under DDoS Attacks in Experiment 2

Figures12–14 display the instantaneous queue for three schemes (i.e., Drop-tail, RED, and SDE-LJN) under the DDoS attack, respectively. From Figures 12 and 13, it is observed that Drop-tail scheme and RED scheme cause the instantaneous queue length serious oscillations and have severe fluctuations of queue length under the attacks. Drop-tail and RED schemes have terrible outcomes because they are not designed to struggle against the attacks. However, Figure 14 indicates that the instantaneous queue length fluctuates around the target with small oscillations under the attacks.Figure 12
The instantaneous queue length under Drop-tail scheme.Figure 13
The instantaneous queue length under RED scheme.Figure 14
The instantaneous queue length under SDE-LJN scheme.


### 4.2.2. TCP Throughput under DDoS Attacks in Experiment 2

Figure15 demonstrates the comparison of TCP throughput of three schemes (i.e., Drop-tail, RED, and SDE-LJN) under the DDoS attack. The CPU utilization at the router affects the throughput, so the throughput could be an indirect reflection of router CPU utilization. We can see from Figure 15 that the normal users’ throughput of two schemes (i.e., Drop-tail and RED) under the DDoS attack is unsatisfactory, since these schemes cannot mitigate the attack traffic, resulting in high CPU utilization at the router, or even overload. Compared with Drop-tail and RED schemes, the TCP throughput of SDE-LJN scheme is persistently satisfactory under the attacks. The high throughput of normal users under SDE-LJN scheme could indirectly indicate that the CPU utilization at the router is reasonable. Our proposed SDE-LJN scheme is more superior to mitigate DDoS attacks and improve the performance of networks than existing queue policy algorithms (herein refer to Drop-tail and RED).Figure 15
Comparison of TCP throughput of Drop-tail, RED, and SDE-LJN under the DDoS attack.Based on the comparison of experiment 1 and experiment 2 above, the simulation results verify the effectiveness of the proposed SDE-LJN system as defense scheme to mitigate DDoS attacks. In order to more clearly demonstrate this fact, we calculate the mean and standard deviation of the instantaneous queue size. Tables1 and 2 show that SDE-LJN scheme can achieve the mean queue length closest to the given target and the minimal standard deviation of the instantaneous queue length. Moreover, the results show that the proposed SDE-LJN scheme succeeds in improving the user’s experience (i.e., throughput).Table 1
Comparison of mean and standard deviation of instantaneous queue in experiment 1.
MeanStandard deviationCircumstance I6.0182e + 034.2677e + 03Circumstance II5.8253e + 035.2641e + 03Circumstance III6.3045e + 035.2491e + 03Circumstance IV1.4649e + 03259.6918Table 2
Comparison of mean and standard deviation of instantaneous queue in experiment 2.
MeanStandard deviationDrop-tail4.0150e + 034.7520e + 03RED4.2051e + 033.0884e + 03SDE-LJN1.4362e + 03524.7265


## 4.2.1. Instantaneous Queue under DDoS Attacks in Experiment 2

Figures12–14 display the instantaneous queue for three schemes (i.e., Drop-tail, RED, and SDE-LJN) under the DDoS attack, respectively. From Figures 12 and 13, it is observed that Drop-tail scheme and RED scheme cause the instantaneous queue length serious oscillations and have severe fluctuations of queue length under the attacks. Drop-tail and RED schemes have terrible outcomes because they are not designed to struggle against the attacks. However, Figure 14 indicates that the instantaneous queue length fluctuates around the target with small oscillations under the attacks.Figure 12
The instantaneous queue length under Drop-tail scheme.Figure 13
The instantaneous queue length under RED scheme.Figure 14
The instantaneous queue length under SDE-LJN scheme.


## 4.2.2. TCP Throughput under DDoS Attacks in Experiment 2

Figure15 demonstrates the comparison of TCP throughput of three schemes (i.e., Drop-tail, RED, and SDE-LJN) under the DDoS attack. The CPU utilization at the router affects the throughput, so the throughput could be an indirect reflection of router CPU utilization. We can see from Figure 15 that the normal users’ throughput of two schemes (i.e., Drop-tail and RED) under the DDoS attack is unsatisfactory, since these schemes cannot mitigate the attack traffic, resulting in high CPU utilization at the router, or even overload. Compared with Drop-tail and RED schemes, the TCP throughput of SDE-LJN scheme is persistently satisfactory under the attacks. The high throughput of normal users under SDE-LJN scheme could indirectly indicate that the CPU utilization at the router is reasonable. Our proposed SDE-LJN scheme is more superior to mitigate DDoS attacks and improve the performance of networks than existing queue policy algorithms (herein refer to Drop-tail and RED).Figure 15
Comparison of TCP throughput of Drop-tail, RED, and SDE-LJN under the DDoS attack.Based on the comparison of experiment 1 and experiment 2 above, the simulation results verify the effectiveness of the proposed SDE-LJN system as defense scheme to mitigate DDoS attacks. In order to more clearly demonstrate this fact, we calculate the mean and standard deviation of the instantaneous queue size. Tables1 and 2 show that SDE-LJN scheme can achieve the mean queue length closest to the given target and the minimal standard deviation of the instantaneous queue length. Moreover, the results show that the proposed SDE-LJN scheme succeeds in improving the user’s experience (i.e., throughput).Table 1
Comparison of mean and standard deviation of instantaneous queue in experiment 1.
MeanStandard deviationCircumstance I6.0182e + 034.2677e + 03Circumstance II5.8253e + 035.2641e + 03Circumstance III6.3045e + 035.2491e + 03Circumstance IV1.4649e + 03259.6918Table 2
Comparison of mean and standard deviation of instantaneous queue in experiment 2.
MeanStandard deviationDrop-tail4.0150e + 034.7520e + 03RED4.2051e + 033.0884e + 03SDE-LJN1.4362e + 03524.7265


## 5. Conclusions

This paper addresses the performance problem of users that is caused by constant-rate DDoS attacks. The main objective of this paper has been to create the stochastic queue model under constant-rate DDoS attacks and to design an automated defense mechanism. By analyzing the stochastic queue system withLe´vy jump noise, the corresponding defense strategy is designed and the stability conditions of the instantaneous queue are obtained. Furthermore, the feedback controller taking into account SDE-LJN system is adopted to enhance the practical applicability and anti-DDoS attacks. The theoretical analysis and simulation results show that the stability of the instantaneous queue can be maintained under the hypotheses so that constant-rate DDoS attacks can be effectively blocked. The stochastic control theory with Le´vy jump noise is applied to constant-rate DDoS attacks defense strategy, and the law of network parameters is presented, which can provide guidelines and application perspectives for designing defense strategies against constant-rate DDoS attacks.


### 5.1. Future Work

The new queue model and feedback controller proposed in this paper provide novel ideas and feasible technical solutions for dealing with constant-rate DDoS attacks, thus solving the intractable problems in the field of network security. Unfortunately, the research in this paper only focuses on the type of constant-rate DDoS attack. However, there are many types of DDoS attacks, such as varying-rate. Other types of DDoS attacks can be studied in the future. Developing more interesting researches to deal with other types of DDoS attacks is the scope of our future work. In the future, we will apply the proposed SDE-LJN scheme to the complex environment of reality and further research on the influence of control systems on all kinds of attacked networks’ performance. Moreover, since the volume of traffic affects the router CPU utilization, the burst traffic can cause high router CPU utilization. If CPU utilization is consistently very high on the router, it is usually considered to be a problem and needs to be investigated. High router CPU utilization (unavailable) causes the network to crash, which is the result of DDoS attacks. Therefore, the first extension to our work will monitor the important metric that is router CPU utilization.


## 5.1. Future Work

The new queue model and feedback controller proposed in this paper provide novel ideas and feasible technical solutions for dealing with constant-rate DDoS attacks, thus solving the intractable problems in the field of network security. Unfortunately, the research in this paper only focuses on the type of constant-rate DDoS attack. However, there are many types of DDoS attacks, such as varying-rate. Other types of DDoS attacks can be studied in the future. Developing more interesting researches to deal with other types of DDoS attacks is the scope of our future work. In the future, we will apply the proposed SDE-LJN scheme to the complex environment of reality and further research on the influence of control systems on all kinds of attacked networks’ performance. Moreover, since the volume of traffic affects the router CPU utilization, the burst traffic can cause high router CPU utilization. If CPU utilization is consistently very high on the router, it is usually considered to be a problem and needs to be investigated. High router CPU utilization (unavailable) causes the network to crash, which is the result of DDoS attacks. Therefore, the first extension to our work will monitor the important metric that is router CPU utilization.



---

*Source: 4733190-2021-10-06.xml*