Tradeoffs of DDoS solutions

Distributed denial of service (DDoS) has become a serious threat to the Internet. Many schemes against DDoS attacks have been proposed, including ingress/egress filtering, IP traceback, authentication, and so on. We focus on tradeoffs of DDoS solutions. Three tradeoffs are considered, the first one is space, complexity, efficiency and robustness tradeoffs of these packet marking schemes; the second one is marking probability of node sampling scheme, the third one is timeout period of server for three-hand-shaking. Two schemes are suggested, one is combining node append scheme with node sampling scheme, the other is setting SYN timeout dynamically. Proper tradeoffs can be made using these schemes.