# Impact of Defending Strategy Decision on DDoS Attack

Authors: Chunming Zhang
Journal: Complexity
 (2021)

---

## Abstract

Distributed denial-of-service (DDoS) attack is a serious threat to cybersecurity. Many strategies used to defend against DDoS attacks have been proposed recently. To study the impact of defense strategy selection on DDoS attack behavior, the current study uses logistic function as basis to propose a dynamic model of DDoS attacks with defending strategy decisions. Thereafter, the attacked threshold of this model is calculated. The existence and stability of attack-free and attacked equilibria are proved. Lastly, some effective strategies to mitigate DDoS attacks are suggested through parameter analysis.


---

## Body

## 1. Introduction

A distributed denial-of-service (DDoS) attack is a cyberattack in which hackers attempt to make a website or computer unavailable by flooding or crashing the website with too much traffic [1, 2]. Given the rapid development of cloud computing, big data, and artificial intelligence, distributed denial-of-service (DDoS) attacks have become one among the most critical threats to network security [3, 4]; for example, in February 2018, the official website of the PyeongChang Winter Olympics Organizing Committee was forced to shut down during the Winter Olympic Games due to a DDoS attack [5]; in March 2018, GitHub suffered a DDoS attack with the maximum peak traffic reaching 1.7 TBPS [6]; in October 2019, Amazon Web Services was attached by DDoS for several hours, resulting in an outage affecting many websites [7]. Therefore, it is an important issue to study the dynamic behavior of DDoS attacks and propose defense strategies on this basis. Numerous models of DDoS attacks have been proposed in recent years. Haldar et al. [8] proposed a DDoS attack model based on the compartment model and obtained threshold conditions that determine the success or failure of such attacks. Kumar et al. [9] presented a dynamic model of DDoS attack in a computer network and studied the dynamic behavior of this model through numerical simulation. Hou et al. [10] investigated a DDoS attack model with a saturated contact infection rate and proved the stability of this model. Mishra et al. [11] considered the characteristics of DDoS attacks on the Internet of Things (IoT) and proposed a DDoS attack model on IoT, given the conditions for a successful attack. Furthermore, some effective defense strategies, such as installing defense software and upgrading firewalls, have been widely used to mitigate DDoS attacks [12, 13]. Several DDoS attack dynamic models with defending strategies have been proposed recently to study the impact of defending strategies on DDoS attacks. Zhang et al. [13] studied a differential dynamics model for DDoS attacks with four states, namely, weak-defensive, attacked, strong-defensive, and compromised nodes. The global stability conditions of the model are given, and some defending strategies are proposed to mitigate the DDoS attack. Zhang et al. [14] used mean-field theory as basis to develop a DDoS attack model on arbitrary networks. Some reasonable strategies for defending against DDoS attacks have been provided based on theoretical analysis. Rao et al. [15] proposed a DDoS attack model with quarantine strategy; mathematical analysis demonstrated that quarantining infected computers can effectively block DDoS attacks. Zhang et al. [16] constructed an optimal control model for DDoS attacks on the Internet of Things and obtained its optimal defense strategy. Huang et al. [17] proposed a new low-cost DDoS attack architecture and got three optimal attack strategies based on variational method. Li et al. [18] established a low-rate DDoS attack model based on cloud computing environment and proposed a strategy to mitigate low-rate DDoS attacks.However, the existing dynamic models have assumed that defenders will adopt a defending strategy with a fixed probability. On the one hand, adopting defending strategies in the real world will benefit from mitigating DDoS attacks. On the other hand, defenders may choose not to adopt defense strategies owing to defensive costs, which can be considered a dilemma. As rational persons, defenders will compare the benefits and costs caused by DDoS attacks. If the benefits outweigh the costs, then defenders will be likely to adopt a defending strategy; otherwise, they will be less likely to adopt such a strategy. That is, defenders decide the probability of adopting a defending strategy based on a cost-benefit analysis. In addition, none of the existing defense strategy recommendations has analyzed the cost-benefit, so the defense strategies obtained are not feasible solutions.To overcome the above shortcomings, this study uses the preceding discussions as bases to first propose a game theory-based DDoS attack model with defending strategy decisions. Our main contributions are summarized as follows:(a)
In order to study the impact of defense strategy decisions on the dynamic behavior of DDoS attacks, according to the above cost-benefit analysis, this research first constructs two smooth logistic functions, which can describe the defense strategy choices of the defender under different cost-benefit conditions. Based on the above logistic function and compartmental model theory, this paper first proposed a game-theoretic DDoS attack dynamics model with a cost-benefit function.(b)
The current study obtains the attack threshold of the above model, which is the condition for successful attack, and then the local stability of the attacked equilibrium and the attack-free equilibrium is proved, using the theory of differential stability. In addition, this study uses the analysis of the impact of parameters on model behavior as basis to propose some effective defending strategies to mitigate DDoS attacks. Some numerical experiments are also presented to verify the effectiveness of defending strategies.The remainder of this paper is organized as follows. Section2 proposes a novel DDoS attack model. Section 3 presents the mathematical properties of the proposed model. Section 4 provides some suggestions for the defense of DDoS attacks by analyzing the effects of parameters on model behavior. Section 5 concludes this study.


## 2. Model Descriptions and Cost-Benefit Analysis

This section proposes a dynamic model with defending strategy decision based on a cost-benefit analysis.


### 2.1. Differential Dynamic Model

A typical computer network system mainly consists of numerous client and server computers. Clients and servers often have different levels of cybervulnerabilities. Clients are considered to be relatively vulnerable to malware and flooding attacks. Servers are often equipped with firewalls. Although they are considerably resilient to malware, servers could still be vulnerable to flooding attacks.A typical DDoS attack and defense is carried out in the following three-phase procedure, which is depicted in Figure1.Figure 1
Schematic of a DDoS attack.


#### 2.1.1. Spreading Malware

Attackers attempt to spread malware to infect normal clients on networks by using fake emails or web links. Once normal clients have been affected by malware, they are controlled by attackers to become zombie clients capable of infecting other clients.


#### 2.1.2. Launching Attacks

Attackers manipulate zombie clients to launch flooding attacks targeting at least one target server. Such attacks will compromise the target servers, thereby losing their abilities to provide services to the external environment.


#### 2.1.3. Recovering

Defenders adopt some defense strategies, such as antivirus software or firewalls, to recover the attacked computers, including zombie clients and compromised servers.The following reasonable assumptions can be obtained on bases of the preceding facts:(H1) Computers on the Internet can be divided into two parts: client and server parts. The total numbers of computers on the client and server parts are NW and NS, respectively [7].(H2) Computers on the client part can be classified into three classes: normal clients (W nodes), infected clients (I nodes), and recovered clients (R nodes) [19, 20]. Let W(t), I(t), and R(t) represent the proportion of the W, I, and R nodes, respectively, in the total number of computers on the client part at time t. The total number is constantly equal to NW:(1)Wt+It+Rt≡1.(H3) Computers on the server part can also be classified into three classes: normal servers (S nodes), compromised servers (C nodes), and recovered servers (D nodes). Let S(t), C(t), and D(t) represent the proportion of the S, C, and D nodes, respectively, in the total number of computers on the server part at time t. The total number is constantly equal to NS:(2)St+Ct+Dt≡1.(H4) Owing the implementation of some dangerous operations, such as browsing phishing sites, a W node will be infected with a probability of β.(H5) Owing to the execution of some positive measures, such as running antivirus software, an I node will recover with a probability of τ.(H6) Owing to the reinstallation of an operation system, an R node becomes a W node with probability γ.(H7) Owing to DDoS attacks, a S node will compromise with probability α.(H8) Owing to the implementation of some positive measures, such as running firewall software, a C node becomes a D node with probability η.(H9) Owing to the reinstallation of an operating system, a D node becomes a S node with probability δ.(H10) Owing to the adoption of some defensive strategies, such as installing antivirus software, a W node becomes a R node with probability f [21, 22].(H11) Owing to the implementation of some defensive strategies, such as upgrading firewall software, a S node becomes a D node with probability g. Probabilities f and g are determined by the cost-benefit analysis of defenders, which we will discuss in part B of this section.Given the preceding assumptions, the following DDoS attack model can be obtained (see Figure2):(3)dWtdt=−βWtIt+γRt−fWt,dItdt=βWtIt−τIt,dRtdt=τIt−γRt+fWt,dStdt=−αStIt+δDt−gSt,dCtdt=αStIt−ηCt,dDtdt=ηCt+gSt−δDt,where 0 ≤ W(t), I(t), R(t), S(t), C(t), D(t)≤1, and 0 ≤ α, β, γ, η, τ, δ ≤ 1.Figure 2
State transition diagram of the proposed model (dashed lines on the graph represent DDoS attacks, and red lines represent defense strategies).


### 2.2. Cost-Benefit Analysis

Although defensive strategies may bring benefits, there are costs to adopting these defensive strategies, which is considered a dilemma for defenders. Logistic function can be used to describe the rational decision problem of whether to adopt defensive strategies. When the cost of adopting a defending strategy is greater than the benefit, defenders will not adopt such a strategy. Otherwise, defenders will adopt this strategy. For the client part, the benefit is directly proportional to the loss of not adopting this strategyLW, the number of computers infected NWI(t), and the probability of infection β. The cost of adopting this strategy is CW. Thus, the total payoff of adopting this strategy for the client part is ΔωW=βNWLWIt−CW. For the server part, let LS represent the cost of not adopting a defending strategy and CW represents the cost of adopting a defending strategy. The total payoff of adopting this strategy for the server part is ΔωS=αNSLSIt−CS.To describe the strategic decision problem, we define the following two logistic functions. Figure3 depicts the logistic equation [23–25].(4)f=ϕ1+eΔωW=ϕ1+eμNWβLWIt−CW=ϕeμCWeμCW+eμNWβLWIt,(5)g=φ1+eΔωS=φ1+eνNSαLSIt−CS=φeνCSeνCS+eνNSαLSIt,where μ and v represent the smooth exponents of functions f and g, respectively, and ϕ and φ represent the maximum value of functions f and g, respectively. 0 ≤ ϕ and φ ≤ 1.Figure 3
Logistic function.


## 2.1. Differential Dynamic Model

A typical computer network system mainly consists of numerous client and server computers. Clients and servers often have different levels of cybervulnerabilities. Clients are considered to be relatively vulnerable to malware and flooding attacks. Servers are often equipped with firewalls. Although they are considerably resilient to malware, servers could still be vulnerable to flooding attacks.A typical DDoS attack and defense is carried out in the following three-phase procedure, which is depicted in Figure1.Figure 1
Schematic of a DDoS attack.


### 2.1.1. Spreading Malware

Attackers attempt to spread malware to infect normal clients on networks by using fake emails or web links. Once normal clients have been affected by malware, they are controlled by attackers to become zombie clients capable of infecting other clients.


### 2.1.2. Launching Attacks

Attackers manipulate zombie clients to launch flooding attacks targeting at least one target server. Such attacks will compromise the target servers, thereby losing their abilities to provide services to the external environment.


### 2.1.3. Recovering

Defenders adopt some defense strategies, such as antivirus software or firewalls, to recover the attacked computers, including zombie clients and compromised servers.The following reasonable assumptions can be obtained on bases of the preceding facts:(H1) Computers on the Internet can be divided into two parts: client and server parts. The total numbers of computers on the client and server parts are NW and NS, respectively [7].(H2) Computers on the client part can be classified into three classes: normal clients (W nodes), infected clients (I nodes), and recovered clients (R nodes) [19, 20]. Let W(t), I(t), and R(t) represent the proportion of the W, I, and R nodes, respectively, in the total number of computers on the client part at time t. The total number is constantly equal to NW:(1)Wt+It+Rt≡1.(H3) Computers on the server part can also be classified into three classes: normal servers (S nodes), compromised servers (C nodes), and recovered servers (D nodes). Let S(t), C(t), and D(t) represent the proportion of the S, C, and D nodes, respectively, in the total number of computers on the server part at time t. The total number is constantly equal to NS:(2)St+Ct+Dt≡1.(H4) Owing the implementation of some dangerous operations, such as browsing phishing sites, a W node will be infected with a probability of β.(H5) Owing to the execution of some positive measures, such as running antivirus software, an I node will recover with a probability of τ.(H6) Owing to the reinstallation of an operation system, an R node becomes a W node with probability γ.(H7) Owing to DDoS attacks, a S node will compromise with probability α.(H8) Owing to the implementation of some positive measures, such as running firewall software, a C node becomes a D node with probability η.(H9) Owing to the reinstallation of an operating system, a D node becomes a S node with probability δ.(H10) Owing to the adoption of some defensive strategies, such as installing antivirus software, a W node becomes a R node with probability f [21, 22].(H11) Owing to the implementation of some defensive strategies, such as upgrading firewall software, a S node becomes a D node with probability g. Probabilities f and g are determined by the cost-benefit analysis of defenders, which we will discuss in part B of this section.Given the preceding assumptions, the following DDoS attack model can be obtained (see Figure2):(3)dWtdt=−βWtIt+γRt−fWt,dItdt=βWtIt−τIt,dRtdt=τIt−γRt+fWt,dStdt=−αStIt+δDt−gSt,dCtdt=αStIt−ηCt,dDtdt=ηCt+gSt−δDt,where 0 ≤ W(t), I(t), R(t), S(t), C(t), D(t)≤1, and 0 ≤ α, β, γ, η, τ, δ ≤ 1.Figure 2
State transition diagram of the proposed model (dashed lines on the graph represent DDoS attacks, and red lines represent defense strategies).


## 2.1.1. Spreading Malware

Attackers attempt to spread malware to infect normal clients on networks by using fake emails or web links. Once normal clients have been affected by malware, they are controlled by attackers to become zombie clients capable of infecting other clients.


## 2.1.2. Launching Attacks

Attackers manipulate zombie clients to launch flooding attacks targeting at least one target server. Such attacks will compromise the target servers, thereby losing their abilities to provide services to the external environment.


## 2.1.3. Recovering

Defenders adopt some defense strategies, such as antivirus software or firewalls, to recover the attacked computers, including zombie clients and compromised servers.The following reasonable assumptions can be obtained on bases of the preceding facts:(H1) Computers on the Internet can be divided into two parts: client and server parts. The total numbers of computers on the client and server parts are NW and NS, respectively [7].(H2) Computers on the client part can be classified into three classes: normal clients (W nodes), infected clients (I nodes), and recovered clients (R nodes) [19, 20]. Let W(t), I(t), and R(t) represent the proportion of the W, I, and R nodes, respectively, in the total number of computers on the client part at time t. The total number is constantly equal to NW:(1)Wt+It+Rt≡1.(H3) Computers on the server part can also be classified into three classes: normal servers (S nodes), compromised servers (C nodes), and recovered servers (D nodes). Let S(t), C(t), and D(t) represent the proportion of the S, C, and D nodes, respectively, in the total number of computers on the server part at time t. The total number is constantly equal to NS:(2)St+Ct+Dt≡1.(H4) Owing the implementation of some dangerous operations, such as browsing phishing sites, a W node will be infected with a probability of β.(H5) Owing to the execution of some positive measures, such as running antivirus software, an I node will recover with a probability of τ.(H6) Owing to the reinstallation of an operation system, an R node becomes a W node with probability γ.(H7) Owing to DDoS attacks, a S node will compromise with probability α.(H8) Owing to the implementation of some positive measures, such as running firewall software, a C node becomes a D node with probability η.(H9) Owing to the reinstallation of an operating system, a D node becomes a S node with probability δ.(H10) Owing to the adoption of some defensive strategies, such as installing antivirus software, a W node becomes a R node with probability f [21, 22].(H11) Owing to the implementation of some defensive strategies, such as upgrading firewall software, a S node becomes a D node with probability g. Probabilities f and g are determined by the cost-benefit analysis of defenders, which we will discuss in part B of this section.Given the preceding assumptions, the following DDoS attack model can be obtained (see Figure2):(3)dWtdt=−βWtIt+γRt−fWt,dItdt=βWtIt−τIt,dRtdt=τIt−γRt+fWt,dStdt=−αStIt+δDt−gSt,dCtdt=αStIt−ηCt,dDtdt=ηCt+gSt−δDt,where 0 ≤ W(t), I(t), R(t), S(t), C(t), D(t)≤1, and 0 ≤ α, β, γ, η, τ, δ ≤ 1.Figure 2
State transition diagram of the proposed model (dashed lines on the graph represent DDoS attacks, and red lines represent defense strategies).


## 2.2. Cost-Benefit Analysis

Although defensive strategies may bring benefits, there are costs to adopting these defensive strategies, which is considered a dilemma for defenders. Logistic function can be used to describe the rational decision problem of whether to adopt defensive strategies. When the cost of adopting a defending strategy is greater than the benefit, defenders will not adopt such a strategy. Otherwise, defenders will adopt this strategy. For the client part, the benefit is directly proportional to the loss of not adopting this strategyLW, the number of computers infected NWI(t), and the probability of infection β. The cost of adopting this strategy is CW. Thus, the total payoff of adopting this strategy for the client part is ΔωW=βNWLWIt−CW. For the server part, let LS represent the cost of not adopting a defending strategy and CW represents the cost of adopting a defending strategy. The total payoff of adopting this strategy for the server part is ΔωS=αNSLSIt−CS.To describe the strategic decision problem, we define the following two logistic functions. Figure3 depicts the logistic equation [23–25].(4)f=ϕ1+eΔωW=ϕ1+eμNWβLWIt−CW=ϕeμCWeμCW+eμNWβLWIt,(5)g=φ1+eΔωS=φ1+eνNSαLSIt−CS=φeνCSeνCS+eνNSαLSIt,where μ and v represent the smooth exponents of functions f and g, respectively, and ϕ and φ represent the maximum value of functions f and g, respectively. 0 ≤ ϕ and φ ≤ 1.Figure 3
Logistic function.


## 3. Theoretical Analysis

This section investigates some mathematical properties of the proposed model, including equilibrium, attacked threshold, and stability of system (3).Given thatW(t) + I(t) + R(t) ≡ 1 and S(t) + C(t) + D(t) ≡ 1, we use a simple calculation to obtain W(t) ≡ 1 − I(t) − R(t) and S(t) ≡ 1 − C(t) − D(t). Hence, the first and fourth equations in system (3) can be represented by the other four equations in this system. Therefore, system (3) can be simplified to the following system:(6)dItdt=β1−It−RtIt−τIt,dRtdt=τIt−γRt+f1−It−Rt,dCtdt=α1−Ct−DtIt−ηCt,dDtdt=ηCt+g1−Ct−Dt−δDt,where f=ϕeμCW/eμCW+eμNWβLWIt and g=φeνCS/eνCS+eνNSαLSIt. The parameter range of system (6) is as follows:(7)Θ=α,β,γ,η,τ,ϕ,φ,μ,ν,LW,LS,CW,CS,NW,NS∈R+15:0≤α,β,γ,η,τ,ϕ,φ≤1.Evidently, the domain of system (6) is as follows:(8)Ω=It,Rt,Ct,Dt∈R+4:0≤It,Rt,Ct,Dt≤1.Given that systems (3) and (6) are equivalent, the remainder of this paper mainly focuses on the properties of system (6).


### 3.1. Attack-Free Equilibrium

Theorem 1.
A unique attack-free equilibriumE0=I0,R0,C0,D0=0,f0/γ+f0,0,g0/δ+g0 is present in system (6), where f0=ϕeμCW/1+eμCW and g0=φeνCS/1+eνCS.Proof.
By solving the following equations,(9)β1−It−RtIt−τIt=0,τIt−γRt+f1−It−Rt=0,α1−Ct−DtIt−ηCt=0,ηCt+g1−Ct−Dt−δDt=0.
E0 is evidently a solution to equation (7). Thus, E0 is constantly an attack-free equilibrium of system (6).Remark 1.
An equilibrium represents a possible final state of DDoS attacks. Thereafter, attack-free equilibrium represents the possible final state of DDoS attack extinction.
The attacked threshold is a crucial parameter that determines whether computers on a network will experience DDoS attacks. This section calculates the attacked threshold by using theFV method proposed in [26, 27].
Lety=It,CtT and y0=I0,C0T. Accordingly, the following functions can be obtained:(10)Fy=F1y,F2yT=β1−It−RtIt,α1−Ct−DtItT,(11)Vy=V1y,V2yT=τIt,ηCtT.
By considering the partial derivative ofI and C at E0, we obtain as follows:(12)F=∂F1y0∂I∂F1y0∂C∂F2y0∂I∂F2y0∂C=β1−R00α1−D00,(13)V=∂V1y0∂A∂V1y0∂C∂V2y0∂A∂V2y0∂C=τ00η.
By calculation, we obtain as follows:(14)FV−1=β1−R00α1−D001τ001η=βτ1−R00ατ1−D00.
The attacked threshold can be obtained by calculating the eigenvalue ofFV−1. Lastly, the two eigenvalues of FV−1 are calculated as ρFV−1=0 and ρFV−1=β/τ1−R0, while the eigenvalue ρFV−1=0 is disregarded. Hence, the attacked threshold can be obtained as follows:(15)T0=βτ1−R0=βγ1+eμCWτγ+γ+ϕeμCW.Theorem 2.
When system (6) is considered, E0 is locally asymptotically stable if T0 < 1.Proof.
When system (6) is considered, the Jacobian matrix at E0 is as follows:(16)β−τ−βf0γ+f0000τ+f0′1−βf0γ+f0−f0−γ−f000α1−g0δ+g00−η01−g0δ+g0g0′0η−g0−δ−g0.
The corresponding characteristic equation can be deduced as follows:(17)β−τ−βf0γ+f0−λ000τ+f0′1−βf0γ+f0−f0−γ−f0−λ00α1−g0δ+g00−η−λ01−g0δ+g0g0′0η−g0−δ−g0−λ,=−η−λ−g0−λ−γ−f0−λβ−τ−βf0γ+f0−λ.
Equation (17) has three negative roots λ1=−η<0, λ2=−g0<0, and λ3=−f0−γ<0. The remaining root is determined by the following equation:(18)β−τ−βf0γ+f0−λ=0.
AsT0=β/τ1−R0=β/τ1−f0/γ+f0<1, by calculation, we obtain as follows:(19)λ4=β−τ−βf0γ+f0<0.
All roots of the characteristic equation (17) are negative. Thus, E0 is locally asymptotically stable if T0 < 1.Remark 2.
Theorem2 shows that DDoS attacks would die out if T0 < 1.Example 1.
Consider system (6) with α = 0.02, β = 0.01, γ = 0.1, δ = 0.1, η = 0.02, τ = 0.005, δ = 0.03, ϕ = 0.6, φ = 0.5, μ = 1, v = 1, NW = 1000, NS = 1000, LW = 1, LS = 1, CW = 1, and CS = 2. By calculation, E0 = (0, 0.814, 0, 0.936)T and T0 = 0.371 < 1 satisfies the condition of Theorem 2. Hence, the system is locally asymptotically stable at E0 (see Figure 4).Figure 4
Stability of the attack-free solutionE0.


### 3.2. Attacked Equilibrium

Theorem 3.
Consider system (6) on domain Ω. If T0 > 1, then system (6) has an attacked equilibrium:(20)E1=I1,R1,C1,D1T,I1=xμNWβLW,(21)R1=1−I1−τβ,(22)C1=δαI1αI1η+δ+ηg1+δ,(23)D1=1−C1−ηC1αI1,where g1=φeνCS/eνCS+eνNSαLSI1 and x is a positive solution of the transcendental equation as follows:(24)τ+γxex+τβγ−γμNWβLWex+τ+γx+μNWβLWeμCWτβγ−γ+τβϕ=0.Proof.
By solving equation (9), we can obtain R=1−I−τ/β, C=δαI/αIη+δ+ηg1+δ, D=1−C−ηC/αI, and I=x/μNWβLWx (0≤x≤μNWβLW) is the root of equation (24).
Thereafter, we examine the existence of the solution of equation (24).
Equation (24) can be organized as follows:(25)τ+γx+μNWβLWγτβ−γ=−μτϕeμCWeμCW+exNWLW.
Let(26)G1x=τ+γx+μNWβLWγτβ−γ,(27)G2x=−ϕeμCWeμCW+exτβμNWβLW.
AsG1′x=τ+γ>0, function G1 is an increasing function. As G2′x=ϕeμCWex/eμCW+ex2τ/βμNWβLW>0, function G2 is also an increasing function.
AsG10=μNWβLWγτ/β−γ and G20=−ϕeμCW/eμCW+1τ/βμNWβLW, according to T0=βγ1+eμCW/τγ+γ+ϕeμCW>1, we have G20>G10. As G1μNWβLW=μNWβLWτ+γτ/β>0 and G2μNWβLW=−ϕeμCW/eμCW+eμNWβLWτ/βμNWβLW<0, G1μNWβLW>G2μNWβLW. Therefore, transcendental equation (24) has at least one solution x (0≤x≤μNWβLW).
The proof is complete.Remark 3.
The attacked equilibrium represents the possible final state of DDoS attacks.Theorem 4.
Consider system (6). If −a11+a22>0, a11a22−a12a21>0, −b11+b22>0, and b11b22−b12b21>0, then E1 is locally asymptotically stable:(28)a11=β1−2I1−R1−τ,(29)a12=−βI1,(30)a21=τ−f1+1−I1−R1f1′,(31)a22=−γ−f1,(32)b11=−αI1−η,(33)b12=−αI1,(34)b21=η−g1,(35)b22=−g1−δ,(36)f1=ϕeμCWeμCW+eμNWβLWI1,(37)g1=φeνCSeνCS+eνNSαLSI1,(38)f1′=μNWβLWϕeμCWeμNWβLWI1eμCW+eμNWβLWI12,(39)g1′=νNSαLSφeνCSeνNSαLSI1eνCS+eνNSαLSI12.Proof.
For system (6), the Jacobian matrix at E1 is(40)β1−2I1−R1−τ−βI100τ−f1+1−I1−R1f1′−γ−f100α1−C1−D10−αI1−η−αI11−C1−D1g1′0η−g1−g1−δ.
The corresponding characteristic equation of the Jacobian matrix (40) can be deduced as follows:(41)β1−2I1−R1−τ−λ−βI100τ−f1+1−I1−R1f1′−γ−f1−λ00α1−C1−D10−αI1−η−λ−αI11−C1−D1g1′0η−g1−g1−δ−λ=a11−λa12a21a22−λb11−λb12b21b22−λ=0,where(42)a11=β1−2I1−R1−τ,a12=−βI1,a21=τ−f1+1−I1−R1f1′,a22=−γ−f1,b11=−αI1−η,b12=−αI1,b21=η−g1,b22=−g1−δ,g1=φeνCSeνCS+eνNSαLSI1,f1=ϕeμCWeμCW+eμNWβLWI1,f1′=μNWβLWϕeμCWeμNWβLWI1eμCW+eμNWβLWI12,g1′=νNSαLSφeνCSeνNSαLSI1eνCS+eνNSαLSI12.
By calculation, the roots of the characteristic equation (41) are determined by the following two equations:(43)λ2−a11+a22λ+a11a22−a12a21=0,λ2−b11+b22λ+b11b22−b12b21=0.
The Hurwitz criterion [28, 29] indicates sufficient conditions for all roots of the characteristic equation (30) to be negative are −a11+a22>0, a11a22−a12a21>0, −b11+b22>0, and b11b22−b12b21>0.
The proof is complete.Remark 4.
Theorems3 and 4 imply that DDoS attacks would persist if conditions in theorems are satisfied.Example 2.
Consider system (6) with α = 0.02, β = 0.05, γ = 0.1, δ = 0.1, η = 0.02, τ = 0.004, δ = 0.03, ϕ = 0.6, φ = 0.5, μ = 1, v = 1, NW = 1000, NS = 1000, LW = 1, LS = 1, CW = 1, and CS = 2. By calculation, E1=0.885,0.035,0.358,0.238T, T0 = 2.321 > 1, −a11+a22=0.144>0, a11a22−a12a21=0.0046>0, −b11+b22=0.068>0, and b11b22−b12b21=0.0015>0 satisfy the condition of Theorem 4. Hence, the system is locally asymptotically stable at E1 (see Figure 5).Figure 5
Stability of the attacked solutionE1.


## 3.1. Attack-Free Equilibrium

Theorem 1.
A unique attack-free equilibriumE0=I0,R0,C0,D0=0,f0/γ+f0,0,g0/δ+g0 is present in system (6), where f0=ϕeμCW/1+eμCW and g0=φeνCS/1+eνCS.Proof.
By solving the following equations,(9)β1−It−RtIt−τIt=0,τIt−γRt+f1−It−Rt=0,α1−Ct−DtIt−ηCt=0,ηCt+g1−Ct−Dt−δDt=0.
E0 is evidently a solution to equation (7). Thus, E0 is constantly an attack-free equilibrium of system (6).Remark 1.
An equilibrium represents a possible final state of DDoS attacks. Thereafter, attack-free equilibrium represents the possible final state of DDoS attack extinction.
The attacked threshold is a crucial parameter that determines whether computers on a network will experience DDoS attacks. This section calculates the attacked threshold by using theFV method proposed in [26, 27].
Lety=It,CtT and y0=I0,C0T. Accordingly, the following functions can be obtained:(10)Fy=F1y,F2yT=β1−It−RtIt,α1−Ct−DtItT,(11)Vy=V1y,V2yT=τIt,ηCtT.
By considering the partial derivative ofI and C at E0, we obtain as follows:(12)F=∂F1y0∂I∂F1y0∂C∂F2y0∂I∂F2y0∂C=β1−R00α1−D00,(13)V=∂V1y0∂A∂V1y0∂C∂V2y0∂A∂V2y0∂C=τ00η.
By calculation, we obtain as follows:(14)FV−1=β1−R00α1−D001τ001η=βτ1−R00ατ1−D00.
The attacked threshold can be obtained by calculating the eigenvalue ofFV−1. Lastly, the two eigenvalues of FV−1 are calculated as ρFV−1=0 and ρFV−1=β/τ1−R0, while the eigenvalue ρFV−1=0 is disregarded. Hence, the attacked threshold can be obtained as follows:(15)T0=βτ1−R0=βγ1+eμCWτγ+γ+ϕeμCW.Theorem 2.
When system (6) is considered, E0 is locally asymptotically stable if T0 < 1.Proof.
When system (6) is considered, the Jacobian matrix at E0 is as follows:(16)β−τ−βf0γ+f0000τ+f0′1−βf0γ+f0−f0−γ−f000α1−g0δ+g00−η01−g0δ+g0g0′0η−g0−δ−g0.
The corresponding characteristic equation can be deduced as follows:(17)β−τ−βf0γ+f0−λ000τ+f0′1−βf0γ+f0−f0−γ−f0−λ00α1−g0δ+g00−η−λ01−g0δ+g0g0′0η−g0−δ−g0−λ,=−η−λ−g0−λ−γ−f0−λβ−τ−βf0γ+f0−λ.
Equation (17) has three negative roots λ1=−η<0, λ2=−g0<0, and λ3=−f0−γ<0. The remaining root is determined by the following equation:(18)β−τ−βf0γ+f0−λ=0.
AsT0=β/τ1−R0=β/τ1−f0/γ+f0<1, by calculation, we obtain as follows:(19)λ4=β−τ−βf0γ+f0<0.
All roots of the characteristic equation (17) are negative. Thus, E0 is locally asymptotically stable if T0 < 1.Remark 2.
Theorem2 shows that DDoS attacks would die out if T0 < 1.Example 1.
Consider system (6) with α = 0.02, β = 0.01, γ = 0.1, δ = 0.1, η = 0.02, τ = 0.005, δ = 0.03, ϕ = 0.6, φ = 0.5, μ = 1, v = 1, NW = 1000, NS = 1000, LW = 1, LS = 1, CW = 1, and CS = 2. By calculation, E0 = (0, 0.814, 0, 0.936)T and T0 = 0.371 < 1 satisfies the condition of Theorem 2. Hence, the system is locally asymptotically stable at E0 (see Figure 4).Figure 4
Stability of the attack-free solutionE0.


## 3.2. Attacked Equilibrium

Theorem 3.
Consider system (6) on domain Ω. If T0 > 1, then system (6) has an attacked equilibrium:(20)E1=I1,R1,C1,D1T,I1=xμNWβLW,(21)R1=1−I1−τβ,(22)C1=δαI1αI1η+δ+ηg1+δ,(23)D1=1−C1−ηC1αI1,where g1=φeνCS/eνCS+eνNSαLSI1 and x is a positive solution of the transcendental equation as follows:(24)τ+γxex+τβγ−γμNWβLWex+τ+γx+μNWβLWeμCWτβγ−γ+τβϕ=0.Proof.
By solving equation (9), we can obtain R=1−I−τ/β, C=δαI/αIη+δ+ηg1+δ, D=1−C−ηC/αI, and I=x/μNWβLWx (0≤x≤μNWβLW) is the root of equation (24).
Thereafter, we examine the existence of the solution of equation (24).
Equation (24) can be organized as follows:(25)τ+γx+μNWβLWγτβ−γ=−μτϕeμCWeμCW+exNWLW.
Let(26)G1x=τ+γx+μNWβLWγτβ−γ,(27)G2x=−ϕeμCWeμCW+exτβμNWβLW.
AsG1′x=τ+γ>0, function G1 is an increasing function. As G2′x=ϕeμCWex/eμCW+ex2τ/βμNWβLW>0, function G2 is also an increasing function.
AsG10=μNWβLWγτ/β−γ and G20=−ϕeμCW/eμCW+1τ/βμNWβLW, according to T0=βγ1+eμCW/τγ+γ+ϕeμCW>1, we have G20>G10. As G1μNWβLW=μNWβLWτ+γτ/β>0 and G2μNWβLW=−ϕeμCW/eμCW+eμNWβLWτ/βμNWβLW<0, G1μNWβLW>G2μNWβLW. Therefore, transcendental equation (24) has at least one solution x (0≤x≤μNWβLW).
The proof is complete.Remark 3.
The attacked equilibrium represents the possible final state of DDoS attacks.Theorem 4.
Consider system (6). If −a11+a22>0, a11a22−a12a21>0, −b11+b22>0, and b11b22−b12b21>0, then E1 is locally asymptotically stable:(28)a11=β1−2I1−R1−τ,(29)a12=−βI1,(30)a21=τ−f1+1−I1−R1f1′,(31)a22=−γ−f1,(32)b11=−αI1−η,(33)b12=−αI1,(34)b21=η−g1,(35)b22=−g1−δ,(36)f1=ϕeμCWeμCW+eμNWβLWI1,(37)g1=φeνCSeνCS+eνNSαLSI1,(38)f1′=μNWβLWϕeμCWeμNWβLWI1eμCW+eμNWβLWI12,(39)g1′=νNSαLSφeνCSeνNSαLSI1eνCS+eνNSαLSI12.Proof.
For system (6), the Jacobian matrix at E1 is(40)β1−2I1−R1−τ−βI100τ−f1+1−I1−R1f1′−γ−f100α1−C1−D10−αI1−η−αI11−C1−D1g1′0η−g1−g1−δ.
The corresponding characteristic equation of the Jacobian matrix (40) can be deduced as follows:(41)β1−2I1−R1−τ−λ−βI100τ−f1+1−I1−R1f1′−γ−f1−λ00α1−C1−D10−αI1−η−λ−αI11−C1−D1g1′0η−g1−g1−δ−λ=a11−λa12a21a22−λb11−λb12b21b22−λ=0,where(42)a11=β1−2I1−R1−τ,a12=−βI1,a21=τ−f1+1−I1−R1f1′,a22=−γ−f1,b11=−αI1−η,b12=−αI1,b21=η−g1,b22=−g1−δ,g1=φeνCSeνCS+eνNSαLSI1,f1=ϕeμCWeμCW+eμNWβLWI1,f1′=μNWβLWϕeμCWeμNWβLWI1eμCW+eμNWβLWI12,g1′=νNSαLSφeνCSeνNSαLSI1eνCS+eνNSαLSI12.
By calculation, the roots of the characteristic equation (41) are determined by the following two equations:(43)λ2−a11+a22λ+a11a22−a12a21=0,λ2−b11+b22λ+b11b22−b12b21=0.
The Hurwitz criterion [28, 29] indicates sufficient conditions for all roots of the characteristic equation (30) to be negative are −a11+a22>0, a11a22−a12a21>0, −b11+b22>0, and b11b22−b12b21>0.
The proof is complete.Remark 4.
Theorems3 and 4 imply that DDoS attacks would persist if conditions in theorems are satisfied.Example 2.
Consider system (6) with α = 0.02, β = 0.05, γ = 0.1, δ = 0.1, η = 0.02, τ = 0.004, δ = 0.03, ϕ = 0.6, φ = 0.5, μ = 1, v = 1, NW = 1000, NS = 1000, LW = 1, LS = 1, CW = 1, and CS = 2. By calculation, E1=0.885,0.035,0.358,0.238T, T0 = 2.321 > 1, −a11+a22=0.144>0, a11a22−a12a21=0.0046>0, −b11+b22=0.068>0, and b11b22−b12b21=0.0015>0 satisfy the condition of Theorem 4. Hence, the system is locally asymptotically stable at E1 (see Figure 5).Figure 5
Stability of the attacked solutionE1.


## 4. Further Discussion

This section investigates the impact of some parameters on the dynamic behavior of the proposed model.From Theorem2, T0 is an important parameter that determines whether DDoS attacks are successful. If T0 < 1, then the attacks will not succeed. Hence, we need to take some measures to make T0 considerably below one.Given thatT0=βγ1+eμCW/τγ+γ+ϕeμCW, taking the derivative with respect to β, γ, τ, ϕ, μ, and CW, we obtain the following:(44)∂T0∂β=γ1+eμCWτγ+γ+ϕeμCW>0,∂T0∂γ=βϕτγ2eμCW1+eμCW1+1+ϕ/γeμCW2>0,∂T0∂ϕ=−βγ1+eμCWeμCWτγ+γ+ϕeμCW2<0,∂T0∂τ=−1τ2βγ1+eμCWγ+γ+ϕeμCW<0,∂T0∂μ=−βϕγτCWeμCWγ+γ+ϕeμCW2<0,∂T0∂CW=−βϕγτμeμCWγ+γ+ϕeμCW2<0.T0 is strictly increasing with parameters β and γ (see Figures 6 and 7) and strictly decreasing with ϕ, τ, μ, and CW (see Figures 8–11).Figure 6
T0 versus β in the case where γ = 0.1, ϕ = 0.6, τ = 0.005, μ = 1, and CW = 1.Figure 7
T0 versus γ in the case where β = 0.03, ϕ = 0.6, τ = 0.005, μ = 1, and CW = 1.Figure 8
T0 versus ϕ in the case where β = 0.03, γ = 0.1, τ = 0.005, μ = 1, and CW = 1.Figure 9
T0 versus τ in the case where β = 0.03, γ = 0.1, ϕ = 0.6, μ = 1, and CW = 1.Figure 10
T0 versus CW in the case where β = 0.03, γ = 0.1, ϕ = 0.6, μ = 1, and τ = 0.005.Figure 11
T0 versus μ in the case where β = 0.03, γ = 0.1, ϕ = 0.6, CW = 1, and τ = 0.005.Some reasonable suggestions for computers on the client prat to mitigate the DDoS attack are provided as follows based on the preceding calculation:(1)
Adopting some defensive strategies (e.g., installing firewalls) on the client part, the infected probabilityβ can be remarkably reduced.(2)
Keeping defensive software updates in time on the client part,γ can be maintained low.(3)
Upgrading antivirus software,τ will be enhanced.(4)
Strengthening defense strength on the client part will enhanceϕ.(5)
Decreasing the cost of the defending strategy will reduceCW.Accordingly, controlling the preceding parameters will be conducive to the mitigation of DDoS attacks on the client part. Thereafter, we focus on the defensive strategies for computers on the server part.AsC1=δαI1/αI1η+δ+ηg1+δ, where g1=φeνCS/eνCS+eνNSαLSI1, parameters δ, α, v, φ, η, NS, CS, and LS are independent of I1. Thus, we investigate the effects of these parameters on C1:(45)∂C1∂δ=αI1αI1η+ηg1αI1η+δ+ηg1+δ2>0.C1 is strictly increasing with parameter δ:(46)C1=δI1I1η+δ+η1/αφeνCS/eνCS+eνNSαLSI1+δ.From the preceding form ofC1, we can see that C1 increases with an increase in α.(47)C1=δαI1αI1η+δ+ηφ/1+eνNSαLSI1−CS+δ.From the form ofC1, we can see that C1 increases with an increase in v, NS, and LS, and C1 decreases with an increase in φ, η, and CS.The following defense strategies are proposed for computers on the server part to deduce DDoS attacks:(1)
Detecting possible security holes may facilitate the reduction inα.(2)
Restarting computers on the server part will significantly increaseη.(3)
Upgrading defensive software of DDoS attack,δ will decrease.(4)
Strengthening defense strength on the server part will enhanceφ.(5)
Decreasing the cost of the defending strategy will reduceCS.(6)
Increasing the number of computers on the server part facilitates the enhancement ofNS.Controlling these parameters is conducive to the mitigation of DDoS attacks on the server part.


## 5. Conclusion

This paper studies the decision-making problem of DDoS attack defense strategy. In order to mitigate DDoS risk with minimum defending loss and cost, based on game theory, this paper establishes a dynamic differential system with the defense cost and loss function. We perform analytical analysis to show that the attack model has two equilibria, i.e., an attack-free equilibriumE0 and an attacked equilibrium E1. The attacked threshold T0 is an important parameter that determines whether DDoS attacks are successful or failed. Some beneficial recommendations to mitigate DDoS attacks are provided after conducting some numerical experiments of the proposed model with different parameters. These suggestions for effective defense against DDoS attacks include installing firewalls, upgrading antivirus software, reducing defense costs, and detecting possible security holes. This research not only has strong theoretical value but can also be widely used in the following fields: (1) advanced persistent threats: study the dynamic behavior of DDoS attack and defense with advanced persistent threat characteristics [30, 31]; (2) Honeynet defense: study the influence of honeynet defense on the dynamic behavior of DDoS attacks [32]; (3) smart grid: study the dynamic behavior of DDoS attack and defense on the smart grid [16].



---

*Source: 6694383-2021-03-16.xml*