{"schema_version":"0.1","map_id":"paper-6-map","publication_id":6,"publication_anchor":"paper-6","slug":"paper-6","canonical_path":"/knowledge/papers/paper-6/","machine_path":"/knowledge/papers/paper-6.json","root_node_id":"paper-6","stage":"mapped_draft","contribution_type_vocabulary_version":"0.1","contribution_types":["algorithm"],"title":"Optimal Filtering for DDoS Attacks","year":2007,"venue":"Information Theory and Applications Workshop (ITA)","topic":"algorithms-foundations","labels":["Theory","Applied"],"authors":["Karim Eldefrawy","Athina Markopoulou","Katerina Argyraki"],"keywords":["DDoS","filter allocation","dynamic programming"],"research_question":"Given a congested victim link and too few packet filters, which individual attackers or aggregate gateways should be filtered or rate-limited to maximize preserved legitimate traffic?","central_answer":"At one aggregation tier the binary formulation is a computationally hard 0-1 knapsack; its fractional, rate-limiting relaxation admits a greedy optimum using filters plus one rate limiter. Across gateway and attacker tiers the problem becomes a cardinality-constrained optimization with an exact dynamic program over gateways, capacity, and filters. Simulations compare these optimized policies and a lower-cost heuristic on synthetic, worm, and commercial-attack scenarios.","curation":{"drafted_at":"2026-07-11","drafted_by":[{"actor_type":"ai","name":"OpenAI Codex","role":"full-text extraction, evidence linking, and initial assessment"}],"method":"Full-source audit of the checked-in arXiv manuscript and archive record.","source_scope":"full_source_audit","approval":{"status":"pending","note":"AI-drafted, source-linked map awaiting author verification before approval."}},"sources":[{"id":"source-paper-6-paper","type":"manuscript_archive","title":"Optimal Filtering for DDoS Attacks","url":"/pubs/2007/optimal-filtering-ddos-ita2007.pdf","media_type":"application/pdf","sha256":"060a455001e42016718e3e0ac46aa85ca5bd335a2f63dcf4739be285c6839b24","page_count":13,"provenance_category":"archive","version_note":"arXiv manuscript cs/0612066; local copy checked 2026-07-11."},{"id":"source-paper-6-arxiv","type":"manuscript_record","title":"arXiv record","url":"https://arxiv.org/abs/cs/0612066"},{"id":"source-paper-6-citations","type":"citation_search","title":"Dated scholarly-web citation search","url":"https://scholar.google.com/scholar?q=%22Optimal+Filtering+for+DDoS+Attacks%22","version_note":"Search attempted 2026-07-11; no transparent citation count was retrievable in this environment."}],"source_anchors":[{"id":"anchor-paper-6-problem","source_id":"source-paper-6-paper","label":"Problem and contributions","locator":"Abstract and Section 1, PDF pages 1-2","url":"/pubs/2007/optimal-filtering-ddos-ita2007.pdf#page=1"},{"id":"anchor-paper-6-assumptions","source_id":"source-paper-6-paper","label":"Filtering model and detection boundary","locator":"Section 2, PDF pages 2-3","url":"/pubs/2007/optimal-filtering-ddos-ita2007.pdf#page=2"},{"id":"anchor-paper-6-single","source_id":"source-paper-6-paper","label":"Single-tier knapsack formulation and greedy optimum","locator":"Section 3.1 and Algorithm 1, PDF pages 3-5","url":"/pubs/2007/optimal-filtering-ddos-ita2007.pdf#page=3"},{"id":"anchor-paper-6-two","source_id":"source-paper-6-paper","label":"Two-tier formulation and dynamic program","locator":"Sections 3.2-3.3 and Algorithm 2, PDF pages 5-8","url":"/pubs/2007/optimal-filtering-ddos-ita2007.pdf#page=5"},{"id":"anchor-paper-6-proof","source_id":"source-paper-6-paper","label":"Optimal-substructure proposition and complexity","locator":"Section 3.3, PDF pages 7-8","url":"/pubs/2007/optimal-filtering-ddos-ita2007.pdf#page=7"},{"id":"anchor-paper-6-evaluation","source_id":"source-paper-6-paper","label":"Synthetic and realistic simulation scenarios","locator":"Section 4, PDF pages 9-12","url":"/pubs/2007/optimal-filtering-ddos-ita2007.pdf#page=9"},{"id":"anchor-paper-6-conclusion","source_id":"source-paper-6-paper","label":"Conclusions and scope","locator":"Section 5, PDF page 13","url":"/pubs/2007/optimal-filtering-ddos-ita2007.pdf#page=13"},{"id":"anchor-paper-6-provenance","source_id":"source-paper-6-arxiv","label":"Public manuscript provenance","locator":"arXiv cs/0612066","url":"https://arxiv.org/abs/cs/0612066"},{"id":"anchor-paper-6-citation-search","source_id":"source-paper-6-citations","label":"Citation search attempted","locator":"Exact-title search, 2026-07-11; no verified count retrieved","url":"https://scholar.google.com/scholar?q=%22Optimal+Filtering+for+DDoS+Attacks%22"}],"nodes":[{"id":"paper-6","kind":"paper","parent_id":null,"order":1,"epistemic_status":"published","title":"Optimal Filtering for DDoS Attacks","summary":"An optimization and algorithm paper for allocating scarce router filters under DDoS traffic while preserving legitimate throughput.","source_anchor_ids":["anchor-paper-6-problem","anchor-paper-6-provenance"]},{"id":"paper-6-question","kind":"question","parent_id":"paper-6","order":1,"epistemic_status":"research_question","title":"Research question","summary":"How should a victim choose filtering granularity under simultaneous link-capacity and filter-count constraints?","source_anchor_ids":["anchor-paper-6-problem"]},{"id":"paper-6-answer","kind":"contribution","parent_id":"paper-6","order":2,"epistemic_status":"proved_and_simulated","title":"Central answer","summary":"Use greedy knapsack allocation at one tier and a Bellman dynamic program when filters may be assigned at both gateway and individual-attacker tiers.","source_anchor_ids":["anchor-paper-6-single","anchor-paper-6-two","anchor-paper-6-evaluation"]},{"id":"paper-6-model","kind":"model","parent_id":"paper-6","order":3,"epistemic_status":"formalized","title":"Traffic and resource model","summary":"A victim gateway knows good and bad traffic rates per attack gateway and attacker, has link capacity C and at most F filters, and optimizes admitted legitimate traffic.","source_anchor_ids":["anchor-paper-6-assumptions","anchor-paper-6-single"]},{"id":"paper-6-single","kind":"algorithm","parent_id":"paper-6","order":4,"epistemic_status":"optimally_solved","title":"Single-tier fractional-knapsack allocation","summary":"Blocking entire gateways yields a computationally hard 0-1 knapsack. Relaxing each decision to a passed traffic fraction models rate limiting; sorting by legitimate-traffic efficiency then gives a fractional-knapsack optimum with filters on later gateways and one rate limiter at the capacity boundary.","source_anchor_ids":["anchor-paper-6-single"]},{"id":"paper-6-two","kind":"algorithm","parent_id":"paper-6","order":5,"epistemic_status":"optimally_solved","title":"Two-tier dynamic program","summary":"The algorithm considers each gateway, residual capacity, and filter budget, choosing how many filters to assign within that gateway and reusing stored optima for the previous gateways.","source_anchor_ids":["anchor-paper-6-two"]},{"id":"paper-6-proof","kind":"theorem","parent_id":"paper-6-two","order":1,"epistemic_status":"proved","title":"Optimal-substructure justification","summary":"A proposition shows that an optimal allocation for n gateways contains an optimal allocation for its first n-1 gateways under the induced capacity and filter budgets, justifying the recurrence.","source_anchor_ids":["anchor-paper-6-proof"]},{"id":"paper-6-complexity","kind":"limitation","parent_id":"paper-6-two","order":2,"epistemic_status":"analyzed","title":"Pseudo-polynomial cost","summary":"The exact table scales with N, discretized capacity C, and filter budget F and can be prohibitively large; the paper therefore also studies a simpler heuristic.","source_anchor_ids":["anchor-paper-6-proof"]},{"id":"paper-6-evidence","kind":"evidence_group","parent_id":"paper-6","order":6,"epistemic_status":"simulation","title":"Comparative simulations","summary":"The algorithms are compared with uniform, random, max-min, and heuristic policies on generated traffic plus Code Red, Slammer, and commercial DDoS-report distributions.","source_anchor_ids":["anchor-paper-6-evaluation"]},{"id":"paper-6-result","kind":"result","parent_id":"paper-6-evidence","order":1,"epistemic_status":"simulation_supported","title":"Goodput/filter tradeoff","summary":"Across the reported scenarios, optimized placement preserves more good traffic and can use fewer filters than baselines; exact magnitudes depend on the assumed traffic distributions and capacity.","source_anchor_ids":["anchor-paper-6-evaluation"]},{"id":"paper-6-boundaries","kind":"limitation_group","parent_id":"paper-6","order":7,"epistemic_status":"material","title":"Model boundaries","summary":"Attack identification is assumed rather than solved, good/bad rates are treated as known, one victim-side hierarchy is optimized, and experiments are simulations rather than router deployment.","source_anchor_ids":["anchor-paper-6-assumptions","anchor-paper-6-evaluation","anchor-paper-6-conclusion"]},{"id":"paper-6-artifacts","kind":"artifact","parent_id":"paper-6","order":8,"epistemic_status":"paper_available_no_code","title":"Artifacts","summary":"A fixed arXiv full text is available locally; algorithm code, scenario inputs, and simulation outputs were not located.","source_anchor_ids":["anchor-paper-6-evaluation","anchor-paper-6-provenance"]},{"id":"paper-6-scrutiny","kind":"scrutiny","parent_id":"paper-6","order":9,"epistemic_status":"peer_reviewed","title":"Scrutiny","summary":"The work appeared at ITA 2007 and has a public preprint; review reports and independent reproduction were not located.","source_anchor_ids":["anchor-paper-6-provenance"]}],"relations":[{"id":"paper-6-relation-model-frames-question","type":"formalizes","from_id":"paper-6-model","to_id":"paper-6-question"},{"id":"paper-6-relation-single-realizes-answer","type":"realizes","from_id":"paper-6-single","to_id":"paper-6-answer"},{"id":"paper-6-relation-two-realizes-answer","type":"realizes","from_id":"paper-6-two","to_id":"paper-6-answer"},{"id":"paper-6-relation-proof-supports-two","type":"supports","from_id":"paper-6-proof","to_id":"paper-6-two"},{"id":"paper-6-relation-evidence-supports-answer","type":"supports","from_id":"paper-6-evidence","to_id":"paper-6-answer"},{"id":"paper-6-relation-complexity-qualifies-two","type":"qualifies","from_id":"paper-6-complexity","to_id":"paper-6-two"},{"id":"paper-6-relation-boundaries-qualify-answer","type":"qualifies","from_id":"paper-6-boundaries","to_id":"paper-6-answer"}],"assessment":{"id":"paper-6-assessment-2026-07-11","rubric_version":"0.2","assessed_at":"2026-07-11","status":"ai_draft_author_review_pending","note":"These dimensions describe documented support and process, not truth, correctness, or a universal ranking. No composite score is calculated.","axes":[{"id":"epistemic_evidence","level":"high","rationale":"The optimization problems, algorithms, optimal-substructure argument, complexity, and comparative simulations are documented; operational detection and deployment are outside the evidence.","basis_source_anchor_ids":["anchor-paper-6-single","anchor-paper-6-two","anchor-paper-6-proof","anchor-paper-6-evaluation"]},{"id":"auditability","level":"high","rationale":"A fixed public arXiv full text is checked in with page count and hash, enabling direct inspection of definitions, algorithms, arguments, and results.","basis_source_anchor_ids":["anchor-paper-6-provenance","anchor-paper-6-proof","anchor-paper-6-evaluation"]},{"id":"production_provenance","level":"medium","rationale":"Named authorship and public manuscript lineage are documented; roles, revision/effort history, tool use, and simulation-code lineage are not.","basis_source_anchor_ids":["anchor-paper-6-provenance"]},{"id":"external_scrutiny","level":"medium","rationale":"The paper has a workshop publication and public preprint, but review reports, code review, and independent replication were not located.","basis_source_anchor_ids":["anchor-paper-6-provenance"]},{"id":"reception","level":"low","rationale":"No citations were verifiably located in the constrained dated search. Under the author's 0-8 rule this is low, but it is not a claim that the paper has no citations.","basis_source_anchor_ids":["anchor-paper-6-citation-search"]},{"id":"contribution_significance","level":"high","rationale":"The work identifies the precise filter/granularity tradeoff, supplies exact algorithms for two settings, and evaluates practical approximations while exposing computational limits.","basis_source_anchor_ids":["anchor-paper-6-problem","anchor-paper-6-two","anchor-paper-6-evaluation"]}]},"reception_snapshot":{"as_of":"2026-07-11","method":"Exact-title scholarly-web search; transparent index count unavailable","source":"Google Scholar query route plus general scholarly-web search","citation_count":0,"signals":[],"limitation":"Zero means no citations were verifiably located during this constrained search, not a total bibliometric count; author should replace it with a confirmed index snapshot."}}