A Differential Game Method Against DDoS Attacks in IoT Botnets: Holistic and Dynamic Perspectives

The recent surge in large-scale Distributed Denial-of-Service (DDoS) attacks, primarily driven by Internet of Things (IoT) botnets, has drawn significant concerns. Defending against IoT botnet DDoS attacks is challenging, especially as attackers’ techniques and strategies become increasingly sophisticated. We propose a novel traffic-level differential game model from holistic and dynamic perspectives to address these challenges, integrating both the botnet formation and DDoS attack stages. Based on the actual operation mechanism of IoT botnet DDoS attacks, we extract two key attack features: 1) the incubation period of infected devices and 2) the threshold effects of DDoS attacks. Considering these, the proposed model more effectively captures the dynamic strategic behaviors of attackers and defenders. Using optimal control theory, we derive the optimal timing and frequency for attackers to activate latent devices and for defenders to restore compromised ones. Numerical simulations show the effectiveness of our defense strategy under both traditional and intelligent attack scenarios, reducing the payoff function of the attack-defense system by approximately 48% compared to static and adaptive strategies. Additionally, we examine the impact of key parameters on network security, providing valuable insights for developing effective defense strategies against botnet-driven DDoS attacks.