Fig. 2

Time evolution of traffic on the target node (left), on a node neighboring the target node (middle), and on a random network node (right). The DDoS attack took place in the range 100 < t < 300 on the CAIDA network structure of May 2004. The DDoS attack is performed by 5% of the network nodes, and the DDoS packet size is z = 1. The blue symbols indicate the normal traffic through the node, the red symbols represent node traffic due to the malicious packets, and the continuous line is the total traffic seen by the node. It is clear that the target node sees an increased traffic during the attack, while traffic on the random node is not influenced significantly. There are very few nodes with intermediate traffic, and they are all in close proximity to the target node