An adaptive control mechanism for mitigating DDoS attacks

Distributed denial-of-service (DDoS) attacks are a major threat to availability of Internet services and resources. We present an adaptive control mechanism that utilizes the Shewhart's control charts based-on network connection to aid in handling DDoS attacks. This mechanism is designed to prevent incoming traffic from exceeding a given threshold, while allowing as much incoming, legitimate traffic as possible. In addition, this mechanism focuses on requiring less demanding modifications to external routers and networks than other published distributed response mechanisms that impact the effect of DDoS attacks. The experimental results show the effectiveness of our scheme in early mitigating DDoS attacks.