1. DDoS Attack and Defense 郭承賓 (Allen C.B. Kuo)

2. Autonomous System Entry node

3. Autonomous System attacker Normal traffic Abnormal traffic

4. 6 5 7 4 13 8 9 10 15 11 14 12 1 2 3 Autonomous System attacker Normal traffic Abnormal traffic

5. Network Model The index set of all nodes in the network – The set of all links in the network – The index set of all entry points in the network – The set of all O-D pairs in the network –

6. Network Model (contd.) The index set of all candidate paths of an O-D pair w – The index set of all candidate paths of node j to node k – The indicator function which denotes if link l is on path p – The indicator function which denotes if link l is used by O-D pair w –

7. QoS Requirement The traffic requirement for O-D pair w – The external traffic requirement to node k via entry j – The end-to-end mean traffic delay requirement upon attack for O-D pair w – The end-to-end delay jitter requirement upon attack for O-D pair w –

8. 6 5 7 4 13 8 9 10 15 11 14 12 1 2 3 attacker Target: node 11

9. 6 5 7 4 13 8 9 10 15 11 14 12 1 2 3 Target: node 11 attacker

10. Attacker Decision Variables Abnormal traffic to node k via entry j – Abnormal traffic via entry j – Total traffic from attacker –

11. Defender Decision Variables The budget allocated to link l – The aggregate traffic flow on link l – The mean traffic delay on link l – The delay jitter on link l – The capacity on link l –

12. Defender Decision Variables (contd.) The routing decision variable which denotes if path p is selected –

13. Constrains Budget – Attacker –

14. Constrains (contd.) Network communication –

15. Constrains (contd.) QoS – Integer –