Fig. 12 shows the results for the AWI LDDoS attack. Our CPR-based approach is still effective – the difference in the average CPR for normal TCP flows and LDDoS flows is evident. However, as Tb decreases (from 10 ms to 0.1 ms), the average CAS of the attack flows under the CAS-based approach also decreases. When Tb is around 0.5 ms, the average CAS of the normal TCP flows and the LDDoS flows is about the same.
Tb
from 10 ms to 0.1 ms
ms
Tb
around 0.5 ms
ms