A Cost-Efficient Retrial Queueing Model for Mitigating DDoS Attacks with Standby Mechanisms

SYN flood attacks, a common form of Distributed Denial of Service (DDoS), severely disrupt service availability in networked systems. To mitigate this threat, a steady-state retrial queueing model is proposed, incorporating key mechanisms such as probabilistic admission control, standby server activation, feedback, retrial attempts, and random breakdowns with preventive maintenance. The system is modeled using batch arrivals to capture the bursty nature of SYN traffic. Analytical expressions for performance measures, including expected orbit size, server utilization, waiting time, and failure frequency are derived using supplementary variable techniques applied to differential equations. Admission control helps manage heavy SYN flood traffic by selectively filtering requests, thus preventing system overload. For practical validation, the model parameters are tuned using SYN flood data from the CICIDS 2017 (Canadian Institute for Cybersecurity 2017) benchmark dataset. Cost optimization of system parameters, such as standby rate and service rate, is achieved using Particle Swarm Optimization (PSO), providing an effective trade-off between service reliability and operational cost. Numerical results and comparative scenario analysis demonstrate the model's robustness and efficiency in handling SYN attacks, offering valuable insights for real-world deployment in cybersecurity infrastructure.