Adaptive Two-Level Allocation of a Conserved Capacity Budget Across Locations and Service Classes

# Adaptive Two-Level Allocation of a Conserved Capacity Budget Across Locations and Service Classes
Source: [https://arxiv.org/html/2608.07747](https://arxiv.org/html/2608.07747)
###### Abstract

We study how to share a single conserved capacity budget across many locations and two service classes when demand is uneven, time\-varying, and can exceed supply\. The shape recurs: an origin’s request\-rate cap split across its edge locations, a licensed throughput cap across premium and standard tenants, or an egress budget between latency\-critical and batch workloads\. We present a two\-level algorithm\. The first level redistributes capacity within a class across locations by proportional deficit and excess redistribution; the second lends capacity elastically between classes when one has surplus and the other deficit\. We prove it conserves the budget exactly, preserves non\-negativity, and reaches a stable allocation in one iteration under stationary demand because it carries no per\-cycle state, atO​\(K​N\)O\(KN\)cost per cycle forKKclasses andNNlocations\. We evaluate it defending a content delivery network’s per\-domain budget under volumetric attack, where the classes are confirmed\-legitimate and not\-yet\-cleared traffic; across 8 contention scenarios on a 22\-location topology it serves 66–93% of high\-priority demand, competitive with a single\-class linear\-programming optimum, while never leaving capacity idle or over\-committing whenever aggregate demand meets or exceeds the budget \(the contention regime these scenarios evaluate\)\. Two findings carry beyond the application\. First, a throughput\-maximizing objective is wrong under contention: a two\-class LP maximizing total served load serves less high\-priority load than our demand\-proportional, reservation\-respecting allocator in most scenarios, because it cannot tell that some load it serves is the contention\. Second, inter\-class borrowing earns its complexity under bursty load, improving high\-priority service by 1\.5 points \(isolated by ablation\), and is neutral under stationary demand\. A 5\-location prototype with real HTTP traffic validates the pipeline\.

## IIntroduction

A recurring problem in distributed systems is sharing one fixed capacity budget across many locations and a small number of service classes\. A controller holds a conserved budgetCCand must, every decision cycle, decide how much of it each location receives, subject to the constraint that the allocations sum toCC\. The budget may be the sustainable request rate of an origin server divided across the edge locations that front it\[[12](https://arxiv.org/html/2608.07747#bib.bib12),[10](https://arxiv.org/html/2608.07747#bib.bib10)\], an inter\-datacenter bandwidth budget split between services of different priority\[[9](https://arxiv.org/html/2608.07747#bib.bib9),[8](https://arxiv.org/html/2608.07747#bib.bib8)\], or a licensed throughput cap shared by tenants across data centers\. In each case the trade\-off is the same: allocate too much to a quiet location and capacity sits idle that a busy location needs; allocate too little to a busy one and its demand is denied\. When demand additionally differs in priority, a class that must be protected versus a class that may be served best\-effort\[[9](https://arxiv.org/html/2608.07747#bib.bib9)\], the controller must split the same budget across classes as well as locations\. This is the problem we study:*two\-level allocation of a conserved budget across locations and two service classes\.*

Two structural facts make this harder than uniform division\. First, demand is uneven across locations and shifts over time, a pattern documented for global edge\-to\-datacenter traffic\[[10](https://arxiv.org/html/2608.07747#bib.bib10)\]and CDN workloads\[[12](https://arxiv.org/html/2608.07747#bib.bib12)\], so an equal split starves the locations where load actually originates while leaving capacity idle elsewhere\. Second, a controller that sizes each location for its own peak must commit, in aggregate, far more than the shared budget: if every one ofNNlocations is provisioned for the full budget, the worst\-case committed capacity isNNtimes the budget, and any cycle in which enough locations are simultaneously busy exceedsCC\. Peak\-provisioning that leaves the aggregate under\-subscribed on average is the same economics that motivated centralized allocation in production wide\-area networks\[[8](https://arxiv.org/html/2608.07747#bib.bib8),[9](https://arxiv.org/html/2608.07747#bib.bib9)\]\. The controller must therefore reclaim that over\-commitment the moment aggregate demand crosses the budget, which is exactly when uniform and static schemes fail\.

We propose an algorithm that operates at two levels\. At the first level it redistributes capacity*within*a class across locations in proportion to observed demand, moving capacity from locations with excess to locations with deficit\. At the second level it allows elastic borrowing*between*the two classes, so capacity left unused by one class flows to the other when that other class has unmet demand, and returns when demand rises again\. Both levels maintain a strict conservation invariant: the sum of all allocations equals the budgetCCat every cycle\. The algorithm is stateless, recomputing allocations from current demand each cycle, which yields one\-step stabilization under stationary demand by construction: a single application reaches a fixed point of the reallocation step\.

The instantiation that motivated this work, and the one we evaluate, is defending a content delivery network’s per\-domain capacity budget during volumetric attacks\[[11](https://arxiv.org/html/2608.07747#bib.bib11),[1](https://arxiv.org/html/2608.07747#bib.bib1)\]\. There the locations are edge regions and the two classes are*confirmed\-legitimate*traffic, which must be protected, and*not\-yet\-cleared*traffic, which is served at reduced priority rather than dropped because the evidence against it is not conclusive\. We use this instantiation for the evaluation and the deployment sections, but the algorithm, its invariants, and its convergence result are stated and proved for the abstract model and do not depend on the contending load being adversarial\. We return to the generality, and to what porting the algorithm to another instantiation would require, in Section[VIII](https://arxiv.org/html/2608.07747#S8)\.

Our contributions are:

- •A formal two\-level allocation algorithm for a conserved budget shared across locations and two service classes, with provable conservation, non\-negativity, and one\-step stabilization, computable inO​\(K​N\)O\(KN\)time per cycle forKKservice classes andNNlocations \(both defined in Section[III](https://arxiv.org/html/2608.07747#S3)\)\.
- •A comparative evaluation against 7 baselines across 8 contention scenarios, with contending load measured in the class it targets\. The baselines span the design space: naive splits, the production heuristic, a DRF\-style weighted max\-min fair allocator, and three LP optima \(single\-class, reservation\-respecting, and unconstrained two\-class\)\. The algorithm is competitive with a single\-class LP optimum on high\-priority load served, and we identify a counterintuitive effect: it serves more high\-priority load than a throughput\-optimal two\-class LP in most scenarios, because maximizing total served load can mean serving the contention itself \(Section[V](https://arxiv.org/html/2608.07747#S5)\)\.
- •An ablation isolating the inter\-class borrowing mechanism: it improves high\-priority service specifically under temporally bursty load and is neutral under stationary demand, locating exactly where the two\-level design earns its complexity \(Section[V](https://arxiv.org/html/2608.07747#S5)\)\.
- •A prototype deployment on a 5\-location testbed with real HTTP traffic validating the counting and aggregation pipeline that feeds the allocator, from per\-process counting through cross\-location transport \(Section[VI](https://arxiv.org/html/2608.07747#S6)\)\.

## IIProblem Statement

Consider a controller that owns a single capacity budgetCCand distributes it acrossNNlocations every decision cycle\. The budget is the maximum aggregate load a shared downstream resource can absorb without degrading\. Demand arrives at each location, is observed by the controller once per cycle, and is served only up to the location’s current allocation; demand beyond the allocation is denied or deferred\.

##### Two service classes\.

Demand at each location is split into two classes that differ in priority\. We call them the*high\-priority*class, whose demand should be protected, and the*best\-effort*class, whose demand is served when capacity allows but yields first under contention\. The budget is partitioned between them: each class is given a*reservation*,RhiR\_\{\\text\{hi\}\}for the high\-priority class andRbeR\_\{\\text\{be\}\}for the best\-effort class, withRhi\+Rbe=CR\_\{\\text\{hi\}\}\+R\_\{\\text\{be\}\}=C\. A reservation is only the share*initially*assigned to a class; the algorithm may lend capacity across the two classes within a cycle \(Section[III](https://arxiv.org/html/2608.07747#S3)\), so a reservation is a starting point, not a hard cap\. We use exactly two classes throughout and do not model a deeper tier hierarchy\. Many priority\-sharing problems reduce to this two\-class form: premium versus standard tenants, latency\-critical versus batch jobs, or, in our evaluated instantiation, confirmed\-legitimate versus not\-yet\-cleared traffic\. How demand is assigned to a class is an input to the allocator, not a contribution of this paper; in the evaluated instantiation a separate upstream classifier produces the labels \(Section[IV](https://arxiv.org/html/2608.07747#S4)\), and demand deemed unserviceable is rejected upstream, consuming no budget and never reaching the allocator\.

##### Notation\.

Indexi∈\{1,…,N\}i\\in\\\{1,\\ldots,N\\\}ranges over locations andc∈\{hi,lo\}c\\in\\\{\\text\{hi\},\\text\{lo\}\\\}over the two classes\. We writeac,ia\_\{c,i\}for the capacity*allocated*to classccat locationiianddc,id\_\{c,i\}for the observed*demand*of classccat locationii\. Aggregates over locations areAc=∑iac,iA\_\{c\}=\\sum\_\{i\}a\_\{c,i\}andDc=∑idc,iD\_\{c\}=\\sum\_\{i\}d\_\{c,i\}\. When the class is clear from context we drop the subscript and writeaia\_\{i\},did\_\{i\}\. The conservation requirement is∑c∑iac,i=C\\sum\_\{c\}\\sum\_\{i\}a\_\{c,i\}=Cat every cycle\.

### II\-AWhy Uniform and Static Splits Fail

Demand across locations is concentrated, not uniform: in the traffic model we use for evaluation \(Section[V](https://arxiv.org/html/2608.07747#S5)\) a minority of locations carry the majority of demand, with a long flat tail across the rest\. Under such skew a uniform split,C/NC/Nto every location, throttles the busy locations far below their demand while the idle locations sit on capacity they cannot use: the uniform share isC/NC/N, but the busiest location can need several times that, so a uniform split denies much of its high\-priority demand\.

The opposite extreme, sizing every location for its own peak by giving each the full budget, avoids that throttling during quiet periods but over\-commits in aggregate: with allNNlocations provisioned forCC, the worst\-case committed capacity isN⋅CN\\cdot C, anN×N\\timesover\-commitment against a budget ofCC\. The committed total is lower when fewer locations are active, scaling with the active count, but once enough locations are simultaneously busy the budget is exceeded and the over\-commitment must be reclaimed in the same cycle, before the shared downstream resource is overwhelmed\. A correct allocator therefore cannot rely on either fixed extreme; it must track demand\.

### II\-BDesign Goals

We want an allocation algorithm that satisfies four properties at each decision cycle:

1. 1\.Conservation:∑c∑iac,i=C\\sum\_\{c\}\\sum\_\{i\}a\_\{c,i\}=Cat all times\.
2. 2\.High\-priority service:Maximize served high\-priority demand,∑imin⁡\(ahi,i,dhi,i\)\\sum\_\{i\}\\min\(a\_\{\\text\{hi\},i\},d\_\{\\text\{hi\},i\}\)\.
3. 3\.Fairness:Locations with proportionally similar demand receive proportionally similar satisfaction ratios\.
4. 4\.Efficiency:Minimize capacity that is allocated but unused\.

## IIIAlgorithm

The algorithm runs at the controller on a fixed decision cycle\. Each cycle it observes per\-location, per\-class demand, computes new allocations, and distributes them to the locations for enforcement\. It carries no state between cycles: allocations are recomputed from the current demand and the fixed reservations\.

### III\-AIntra\-Class Reallocation

For a single class with total reserved capacityRRdistributed acrossNNlocations, let𝐚=\[a1,…,aN\]\\mathbf\{a\}=\[a\_\{1\},\\ldots,a\_\{N\}\]be the current allocations and𝐝=\[d1,…,dN\]\\mathbf\{d\}=\[d\_\{1\},\\ldots,d\_\{N\}\]be the observed demands\.

We classify each location as having either excess capacity \(ai\>dia\_\{i\}\>d\_\{i\}\) or deficit \(di\>aid\_\{i\}\>a\_\{i\}\), then redistribute according to Algorithm[1](https://arxiv.org/html/2608.07747#alg1)\.

Algorithm 1Intra\-Class Reallocation0:Allocations

𝐚\\mathbf\{a\}, demands

𝐝\\mathbf\{d\}
0:New allocations

𝐚′\\mathbf\{a^\{\\prime\}\}with

∑ai′=∑ai\\sum a^\{\\prime\}\_\{i\}=\\sum a\_\{i\}
1:

ei←max⁡\(0,ai−di\)e\_\{i\}\\leftarrow\\max\(0,a\_\{i\}\-d\_\{i\}\)for all

ii
2:

fi←max⁡\(0,di−ai\)f\_\{i\}\\leftarrow\\max\(0,d\_\{i\}\-a\_\{i\}\)for all

ii
3:

E←∑ieiE\\leftarrow\\sum\_\{i\}e\_\{i\};

F←∑ifiF\\leftarrow\\sum\_\{i\}f\_\{i\}
4:if

E=0E=0or

F=0F=0then

5:return

𝐚\\mathbf\{a\}
6:endif

7:if

E≥FE\\geq Fthen

8:// Enough excess to cover all deficits

9:for all

iiwith

fi\>0f\_\{i\}\>0do

10:

ai′←dia^\{\\prime\}\_\{i\}\\leftarrow d\_\{i\}
11:endfor

12:for all

iiwith

ei\>0e\_\{i\}\>0do

13:

ai′←ai−eiE⋅Fa^\{\\prime\}\_\{i\}\\leftarrow a\_\{i\}\-\\frac\{e\_\{i\}\}\{E\}\\cdot F
14:endfor

15:else

16:// Not enough excess, share proportionally

17:for all

iiwith

ei\>0e\_\{i\}\>0do

18:

ai′←dia^\{\\prime\}\_\{i\}\\leftarrow d\_\{i\}
19:endfor

20:for all

iiwith

fi\>0f\_\{i\}\>0do

21:

ai′←ai\+fiF⋅Ea^\{\\prime\}\_\{i\}\\leftarrow a\_\{i\}\+\\frac\{f\_\{i\}\}\{F\}\\cdot E
22:endfor

23:endif

24:return

𝐚′\\mathbf\{a^\{\\prime\}\}

The key insight is proportionality\. When excess exceeds deficit, every deficit location gets exactly what it needs, and excess locations give up proportional to how much spare capacity they have\. When deficit exceeds excess, all available excess is distributed proportionally to how much each deficit location needs\. This ensures fairness without requiring optimization solvers\.

###### Theorem 1\(Conservation\)\.

Algorithm[1](https://arxiv.org/html/2608.07747#alg1)preserves∑iai′=∑iai\\sum\_\{i\}a^\{\\prime\}\_\{i\}=\\sum\_\{i\}a\_\{i\}\.

###### Proof\.

In Case 1 \(E≥FE\\geq F\): deficit locations gain a total ofFF\. Excess locations lose∑i:ei\>0eiE⋅F=FE​∑i:ei\>0ei=F\\sum\_\{i:e\_\{i\}\>0\}\\frac\{e\_\{i\}\}\{E\}\\cdot F=\\frac\{F\}\{E\}\\sum\_\{i:e\_\{i\}\>0\}e\_\{i\}=F\. Net change is zero\.

In Case 2 \(E<FE<F\): excess locations lose a total ofEE\(they drop to their demand level\)\. Deficit locations gain∑i:fi\>0fiF⋅E=EF​∑i:fi\>0fi=E\\sum\_\{i:f\_\{i\}\>0\}\\frac\{f\_\{i\}\}\{F\}\\cdot E=\\frac\{E\}\{F\}\\sum\_\{i:f\_\{i\}\>0\}f\_\{i\}=E\. Net change is zero\. ∎

###### Theorem 2\(Non\-negativity\)\.

If all inputs are non\-negative, all outputs are non\-negative\.

###### Proof\.

In Case 1, deficit locations receivedi≥0d\_\{i\}\\geq 0\. Excess locations retainai−eiE⋅F≥ai−eiE⋅E=ai−ei=di≥0a\_\{i\}\-\\frac\{e\_\{i\}\}\{E\}\\cdot F\\geq a\_\{i\}\-\\frac\{e\_\{i\}\}\{E\}\\cdot E=a\_\{i\}\-e\_\{i\}=d\_\{i\}\\geq 0\.

In Case 2, excess locations receivedi≥0d\_\{i\}\\geq 0\. Deficit locations receiveai\+fiF⋅E≥ai≥0a\_\{i\}\+\\frac\{f\_\{i\}\}\{F\}\\cdot E\\geq a\_\{i\}\\geq 0\. ∎

### III\-BInter\-Class Elastic Allocation

The second level handles reallocation between classes\. GivenKKclasses with reservations\{Rc\}\\\{R\_\{c\}\\\}and aggregate demands\{Dc=∑idc,i\}\\\{D\_\{c\}=\\sum\_\{i\}d\_\{c,i\}\\\}, a class has surplus whenRc\>DcR\_\{c\}\>D\_\{c\}and deficit whenDc\>RcD\_\{c\}\>R\_\{c\}\. We state the algorithm for generalKK; throughout this paperK=2K=2\.

Algorithm 2Inter\-Class Elastic Allocation0:Class reservations

\{Rc\}\\\{R\_\{c\}\\\}, class demands

\{Dc\}\\\{D\_\{c\}\\\}
0:Class budgets

\{Ac\}\\\{A\_\{c\}\\\}
1:

Ac←min⁡\(Dc,Rc\)A\_\{c\}\\leftarrow\\min\(D\_\{c\},R\_\{c\}\)for all

cc
2:

sc←max⁡\(0,Rc−Dc\)s\_\{c\}\\leftarrow\\max\(0,R\_\{c\}\-D\_\{c\}\)for all

cc
3:

fc←max⁡\(0,Dc−Rc\)f\_\{c\}\\leftarrow\\max\(0,D\_\{c\}\-R\_\{c\}\)for all

cc
4:

S←∑cscS\\leftarrow\\sum\_\{c\}s\_\{c\};

F←∑cfcF\\leftarrow\\sum\_\{c\}f\_\{c\}
5:if

S\>0S\>0and

F\>0F\>0then

6:for all

ccwith

fc\>0f\_\{c\}\>0do

7:

Ac←Ac\+min⁡\(fc,S⋅fcF\)A\_\{c\}\\leftarrow A\_\{c\}\+\\min\\left\(f\_\{c\},\\;S\\cdot\\frac\{f\_\{c\}\}\{F\}\\right\)
8:endfor

9:endif

10:return

\{Ac\}\\\{A\_\{c\}\\\}

When one class has unused capacity, for example during a window in which best\-effort demand momentarily drops, that capacity flows to the other class and returns when the lending class’s demand rises again\. This inter\-class mechanism is what lets the two\-level algorithm serve more high\-priority demand than a per\-cycle optimum when demand varies over time \(Section[V](https://arxiv.org/html/2608.07747#S5)\)\. It does not contradict LP optimality: a per\-cycle LP recomputes from current demand and has no notion of holding capacity across a temporal cycle, whereas our algorithm’s elastic borrowing spans cycles\. The same mechanism would also be driven by any process that shifts demand between the classes over time, such as labels being refined by an upstream classifier; we do not model such dynamics here, so the benefit we report comes purely from temporal variation in load volume\.

### III\-CCombined Two\-Level Algorithm

Each decision cycle executes three steps:

1. 1\.Run Algorithm[2](https://arxiv.org/html/2608.07747#alg2)to determine per\-class budgets\{Ac\}\\\{A\_\{c\}\\\}\.
2. 2\.For each classcc, scale base per\-location allocations byAc/RcA\_\{c\}/R\_\{c\}\.
3. 3\.For each classcc, run Algorithm[1](https://arxiv.org/html/2608.07747#alg1)on the scaled allocations\.

The time complexity isO​\(K​N\)O\(KN\)per decision cycle whereKKis the number of classes \(two throughout this paper\) andNNis the number of locations\. In the deployment described in Section[IV](https://arxiv.org/html/2608.07747#S4), with 2 classes and 22 locations, each cycle is a fixed number of passes overK​N=44KN=44per\-location entries, negligible against the 10\-second decision cycle\.

### III\-DConvergence

The algorithm is stateless: each cycle recomputes allocations from the current demand and a fixed base reservation, and never feeds the previous cycle’s output back as input\. What this buys is stability, not a unique closed\-form target: we show below that one application of the reallocation step lands on a fixed point of that step, so a second application with the same demand changes nothing\. We are careful about what this does and does not claim\. It does*not*claim a unique allocation independent of the input: when a class is under\-provisioned \(aggregate demand exceeds the class budget\), the step has a continuum of fixed points, and two equal\-sum input allocations under the same demand can settle on different stable allocations\. The result matters less as a convergence guarantee in its own right and more as a contrast with heuristics whose allocation is a discontinuous function of the demand vector, such as the breach\-count scheme evaluated in Section[V](https://arxiv.org/html/2608.07747#S5), which can fail to settle when demand noise moves locations back and forth across its threshold\.

###### Theorem 3\(One\-Step Stabilization\)\.

Fix a demand vector𝐝\\mathbf\{d\}and let𝐚\\mathbf\{a\}be any allocation with∑iai=T\\sum\_\{i\}a\_\{i\}=T\. Let𝐚′\\mathbf\{a^\{\\prime\}\}be the output of Algorithm[1](https://arxiv.org/html/2608.07747#alg1)on\(𝐚,𝐝\)\(\\mathbf\{a\},\\mathbf\{d\}\)\. Then applying Algorithm[1](https://arxiv.org/html/2608.07747#alg1)again to\(𝐚′,𝐝\)\(\\mathbf\{a^\{\\prime\}\},\\mathbf\{d\}\)returns𝐚′\\mathbf\{a^\{\\prime\}\}unchanged: one application reaches a fixed point of the reallocation step\. The fixed point is not unique in general; it depends on𝐚\\mathbf\{a\}when the class is deficit\-dominant \(Case 2 below\)\.

###### Proof\.

LetT=∑iaiT=\\sum\_\{i\}a\_\{i\}\(preserved by Theorem[1](https://arxiv.org/html/2608.07747#Thmtheorem1)\)\. DefineE​\(𝐚\)=∑imax⁡\(0,ai−di\)E\(\\mathbf\{a\}\)=\\sum\_\{i\}\\max\(0,a\_\{i\}\-d\_\{i\}\)\(total excess\) andF​\(𝐚\)=∑imax⁡\(0,di−ai\)F\(\\mathbf\{a\}\)=\\sum\_\{i\}\\max\(0,d\_\{i\}\-a\_\{i\}\)\(total deficit\), and noteE−F=T−∑idiE\-F=T\-\\sum\_\{i\}d\_\{i\}is fixed for givenTTand𝐝\\mathbf\{d\}\.

After one application, every location that had excess \(ai\>dia\_\{i\}\>d\_\{i\}\) or deficit \(ai<dia\_\{i\}<d\_\{i\}\) is moved toward its demand: in Case 1 \(E≥FE\\geq F\) deficit locations are set exactly todid\_\{i\}; in Case 2 \(E<FE<F\) excess locations are set exactly todid\_\{i\}\. So in𝐚′\\mathbf\{a^\{\\prime\}\}, one side of the excess/deficit split is pinned to demand\. Consider the second application on𝐚′\\mathbf\{a^\{\\prime\}\}:

Case 1 \(E≥FE\\geq F\): deficit locations of𝐚′\\mathbf\{a^\{\\prime\}\}already satisfyai′=dia^\{\\prime\}\_\{i\}=d\_\{i\}, so they contribute zero deficit; only the former excess locations retainai′≥dia^\{\\prime\}\_\{i\}\\geq d\_\{i\}, and their total excess isE−F=T−∑idi≥0E\-F=T\-\\sum\_\{i\}d\_\{i\}\\geq 0, matched by zero deficit\. WithF​\(𝐚′\)=0F\(\\mathbf\{a^\{\\prime\}\}\)=0, Algorithm[1](https://arxiv.org/html/2608.07747#alg1)returns its input unchanged \(theF=0F=0guard\)\. Case 2 \(E<FE<F\): excess locations of𝐚′\\mathbf\{a^\{\\prime\}\}satisfyai′=dia^\{\\prime\}\_\{i\}=d\_\{i\}, soE​\(𝐚′\)=0E\(\\mathbf\{a^\{\\prime\}\}\)=0, and theE=0E=0guard returns the input unchanged\. Either way𝐚′\\mathbf\{a^\{\\prime\}\}is a fixed point\.

Non\-uniqueness in Case 2: the deficit locations receiveai′=ai\+fiF​Ea^\{\\prime\}\_\{i\}=a\_\{i\}\+\\frac\{f\_\{i\}\}\{F\}Ewithfi=di−aif\_\{i\}=d\_\{i\}\-a\_\{i\}, which depends on the input𝐚\\mathbf\{a\}, so two equal\-sum inputs under the same𝐝\\mathbf\{d\}can yield different \(each still stable\) outputs\. The claim is one\-step stabilization, not a unique target\. ∎

This matches the empirical observation in Section[V](https://arxiv.org/html/2608.07747#S5): the allocation settles in 1 iteration across all 8 scenarios\. The reason a*single*run of the deployed controller is fully determined despite the non\-uniqueness is that the controller recomputes each cycle from a fixed base allocation rather than from the previous cycle’s output, so the input to the step is the same every cycle: determinism here comes from a fixed input, not from a unique fixed point\. Because the allocation is a continuous, demand\-proportional function of that input, it avoids the instability of schemes whose allocation depends discontinuously on how many locations cross a threshold\.

## IVInstantiation: CDN Capacity Defense

We now ground the abstract model in the deployment that motivated it\. In the CDN instantiation the locations are edge regions, the high\-priority and best\-effort classes are confirmed\-legitimate and not\-yet\-cleared traffic, and the conserved budget is a domain’s per\-domain limit in requests per minute \(RPM\), representing the maximum load the domain’s origin server can handle without degradation\. The decision cycle is 10 seconds\. The allocator runs inside a hierarchical counting and control system spanning 22 geographic regions, organized in four tiers:

Pod Counter \(Tier 1\):A Rust library compiled as both a native shared object \(for Nginx via LuaJIT FFI\) and a WASM module \(for Envoy\)\. It performs lock\-free atomic per\-domain counting on each request and flushes deltas to the cluster on a short fixed interval\.

Cluster Aggregator \(Tier 2\):A Go service that receives pod flushes, maintains a Redis\-backed sliding window, and forwards aggregated counts to the region\.

Region Aggregator \(Tier 3\):A Go service maintaining a G\-Counter CRDT per domain\. It participates in cross\-region synchronization periodically\. The CRDT guarantees eventual consistency and partition tolerance without requiring coordination\.

Control Plane \(Tier 4\):A central Go service that pulls global state from all region aggregators, detects hot domains, consumes per\-request class labels from an upstream classifier \(Section[IV\-A](https://arxiv.org/html/2608.07747#S4.SS1)\), runs the allocation algorithm of Section[III](https://arxiv.org/html/2608.07747#S3), and pushes new allocations back to the regions\.

Each stage adds a small fixed delay, so the end\-to\-end latency from a demand change to a new allocation is on the order of the decision cycle; the exact per\-tier intervals are deployment\-tuning parameters rather than properties of the algorithm\.

### IV\-AWhere the Class Labels Come From

How requests are assigned to the high\-priority and best\-effort classes is an input to the allocator, not a contribution of this paper; any mechanism that produces a per\-request class label can be substituted, and the allocation algorithm is unchanged\. In our CDN instantiation an upstream classifier assigns each request to confirmed\-legitimate \(high\-priority\) or not\-yet\-cleared \(best\-effort\), and requests that match threat\-intelligence feeds outright are dropped upstream and never reach the allocator\. The only property the allocator relies on is that labels may be*refined over time*: as an attack progresses and the classifier gains confidence, actors move out of the not\-yet\-cleared class, reducing best\-effort demand and freeing capacity that inter\-class borrowing can lend to the high\-priority class\. We do not model these classifier dynamics in the evaluation; the temporal benefit we report \(Section[V](https://arxiv.org/html/2608.07747#S5)\) comes purely from variation in load volume\.

## VEvaluation

We evaluate in the CDN instantiation, and this section uses its vocabulary: locations are regions, high\-priority demand is legitimate traffic, and the contending load is attack traffic\.

### V\-AExperimental Setup

We evaluate on a simulated CDN with 22 regions, matching our deployment topology\. The total capacity budget is 10,000 RPM, partitioned into a 75% high\-priority reservation and a 25% best\-effort reservation\. Of the legitimate traffic itself, 85% is high\-priority and 15% is best\-effort; the high\-priority reservation is sized slightly above the high\-priority share so that peacetime traffic fits within it\. Legitimate traffic runs at 80% of capacity on average \(75% in the diurnal scenario, which adds a daily swing\)\.

Demand is geographically skewed\. We assign region weights so that a minority of regions carry most of the demand: in the default configuration the three busiest regions together draw a little over 40% of demand and the top eight about two\-thirds, with the remaining regions sharing a flat tail\. Long\-tailed geographic concentration, where a small number of regions dominate request volume, is a qualitative pattern reported for CDN and edge traffic\[[12](https://arxiv.org/html/2608.07747#bib.bib12),[10](https://arxiv.org/html/2608.07747#bib.bib10)\]; the specific concentration here is a parameter of our traffic model, not a measurement of any one deployment\. We model time\-of\-day demand with a multiplicative diurnal factor1\+α​sin⁡\(2​π​t/100\)1\+\\alpha\\sin\(2\\pi t/100\)applied to the baseline, wherettis the iteration index and 100 iterations represent one daily cycle\. The amplitudeα\\alphais 0\.3 for the seven non\-diurnal scenarios, a±30%\\pm 30\\%swing around the mean; the diurnal scenario usesα=0\.25\\alpha=0\.25so its peak sits near capacity\. Per\-region demand additionally carries multiplicative noise, a±30%\\pm 30\\%jitter drawn independently per region per cycle and clipped to\[0\.7,1\.3\]\[0\.7,1\.3\]; the clip keeps demand strictly positive and bounded so a single draw cannot dominate or zero out a region, matching the±30%\\pm 30\\%diurnal amplitude\. The bound is a modeling choice, not a measured quantity, and the results are not sensitive to its exact value\.

All experiments use 200 iterations per run with 5 random seeds each\. Attack traffic starts at iteration 20\. The first 20 iterations let the system settle into a representative pre\-attack allocation and demand level, so that the attack phase measures adaptation from a realistic operating point rather than from a cold start\. We report metrics averaged over the attack phase \(iterations 20\-200\)\. Attack load is not confined to one class: each scenario splits it between the two classes by a per\-scenario fraction, with the application\-layer portion that mimics legitimate users landing in the high\-priority class and the purely volumetric portion in the best\-effort class\. This split is deliberate, it forces genuine contention inside the high\-priority class rather than measuring a class the attack never reaches, and the fraction is varied across scenarios \(from best\-effort\-heavy volumetric floods to high\-priority\-heavy application\-layer attacks\) so the evaluation covers both\.

### V\-BContention Scenarios

We evaluate 8 scenarios designed to create real capacity contention \(total demand exceeds capacity\)\. They are described in the CDN instantiation’s terms \(an attack is the source of the excess load\), but each is simply a spatial\-temporal pattern of demand that exceeds the budget:

- •Concentrated:100% capacity excess on a single region\.
- •Distributed:80% capacity excess spread across all 22 regions\.
- •Rotating:Excess shifts between 3 regions every 10 iterations\.
- •Pulse:On/off bursts at 120% capacity every 5 iterations\.
- •Slow ramp:Gradual increase from 0 to 150% capacity over 40 iterations\.
- •Diurnal \+ Attack:Excess load during the peak\-traffic hour\.
- •Contention:Simultaneous excess on 4 regions\.
- •Asymmetric:Excess targets quiet regions \(opposite of where high\-priority demand concentrates\)\.

### V\-CBaselines

- •Static Uniform:Each region getsC/NC/Nregardless of demand\.
- •Divide\-by\-Breach:Divide the budget equally among the locations currently over their limit; within a location, a fixed 75/25 ratio splits capacity between the classes\. This is representative of the simple over\-limit\-counting heuristics common in production rate limiters prior to demand\-aware allocation, included only to show how such a scheme behaves on these scenarios; we make no claim that it is optimal or a state\-of\-the\-art baseline\. It has three structural weaknesses the results make precise: it cannot distinguish a location far over its limit from one slightly over \(both get the same share\); it cannot move capacity left unused by one class to the other; and its allocation is a discontinuous function of the over\-limit count, so it can fail to settle when many locations sit near the threshold\.
- •Proportional:Allocate proportional to observed demand\.
- •LP Optimal \(1\-class\):Water\-filling solution maximizing∑imin⁡\(ai,di\)\\sum\_\{i\}\\min\(a\_\{i\},d\_\{i\}\)subject to∑iai=Rc\\sum\_\{i\}a\_\{i\}=R\_\{c\}within each class reservation\. This is the theoretical optimum for single\-class allocation\.
- •LP Optimal \(2\-class\):Water\-filling over the pooled budget across both classes and all regions, maximizing∑c∑imin⁡\(ac,i,dc,i\)\\sum\_\{c\}\\sum\_\{i\}\\min\(a\_\{c,i\},d\_\{c,i\}\)subject to∑c,iac,i=C\\sum\_\{c,i\}a\_\{c,i\}=C\. This is the throughput optimum for the full two\-dimensional problem, and the correct upper bound for the inter\-class\-borrowing claim\. It is allowed to move capacity across both classes, so the proposed algorithm cannot exceed it on total served traffic within a cycle; comparing against it prevents overstating the contribution\.
- •LP Optimal \(reservation\-respecting\):The point between the two LP baselines above\. It first guarantees each class a floor ofmin⁡\(Dc,Rc\)\\min\(D\_\{c\},R\_\{c\}\)within its own reservation, then pools the leftover budgetC−∑cmin⁡\(Dc,Rc\)C\-\\sum\_\{c\}\\min\(D\_\{c\},R\_\{c\}\)across all \(class, location\) cells by water\-filling on residual demand\. Unlike the 2\-class LP it cannot starve the high\-priority class to serve contending load, and unlike the 1\-class LP it can lend a class’s idle capacity to the other\. It is the*optimal*version of the borrow\-above\-floor policy the proposed algorithm implements heuristically, so it is the tightest reference for that policy\.
- •Weighted Max\-Min \(DRF\-style\):Weighted max\-min fair allocation over all \(class, location\) cells by weighted water\-filling: raise a common levelλ\\lambdaand give each cellmin⁡\(dc,i,λ​wc\)\\min\(d\_\{c,i\},\\lambda w\_\{c\}\), withλ\\lambdachosen so the allocation sums toCC\. The per\-class weightwcw\_\{c\}is the class reservation, so the high\-priority class is weighted three times the best\-effort class, matching the reservation split rather than adding a new knob\. This follows the Dominant Resource Fairness principle\[[7](https://arxiv.org/html/2608.07747#bib.bib7)\]that the fairness objective must track the structure of demand, and mirrors the per\-class weighted max\-min fairness used inside SWAN\[[8](https://arxiv.org/html/2608.07747#bib.bib8)\]and BwE\[[9](https://arxiv.org/html/2608.07747#bib.bib9)\]\. It is the principled fairness baseline the rest of the set lacks\.

### V\-DMetrics

- •High\-Priority Served \(%\):Fraction of high\-priority demand that can be satisfied,∑imin⁡\(ahi,i,dhi,i\)∑idhi,i\\frac\{\\sum\_\{i\}\\min\(a\_\{\\text\{hi\},i\},d\_\{\\text\{hi\},i\}\)\}\{\\sum\_\{i\}d\_\{\\text\{hi\},i\}\}\. In the CDN instantiation this is legitimate traffic served, and we use the two terms interchangeably below\.
- •Capacity Utilization \(%\):Fraction of allocated capacity that is actually used,∑imin⁡\(ai,di\)∑iai\\frac\{\\sum\_\{i\}\\min\(a\_\{i\},d\_\{i\}\)\}\{\\sum\_\{i\}a\_\{i\}\}\.
- •Demand\-Weighted Fairness:Jain’s fairness index applied to per\-region satisfaction ratios\.
- •Convergence:Number of iterations until allocation changes drop below 5% for 3 consecutive iterations\.

### V\-EResults

Table[I](https://arxiv.org/html/2608.07747#S5.T1)summarizes performance across all 8 scenarios\.

TABLE I:Performance across 8 contention scenarios \(mean / worst\-case\)AlgorithmServedUtil\.Fair\.Conv\.Adaptive \(ours\)66–93%100%0\.991Weighted Max\-Min§66–95%97%0\.991LP Optimal \(1\-class\)66–92%97%0\.991LP Optimal \(resv\.\)66–93%97%0\.991LP Optimal \(2\-class\)55–91%97%0\.981Proportional55–90%97%0\.981–107†Static Uniform59–69%65%0\.951Divide\-by\-Breach75–98%7%‡0\.991–21∗∗Fails to settle under distributed attacks \(5 of 40 runs\)\.†Slow to settle under distributed attacks\.‡Low utilization reflects gross over\-allocation, see text\.§Higher high\-priority served, but by holding the best\-effort class below its reservation split, a harder priority policy rather than a strict improvement, see text\.Served ranges span the 8 scenarios \(min–max of per\-scenario means\); they reflect scenario spread, not seed variance\. Each per\-scenario mean is over 5 seeds with a 95% CI within±0\.5\\pm 0\.5points\.These numbers tell a more nuanced story than utilization alone would suggest, and we read them honestly\. On*high\-priority served*, the proposed algorithm \(66–93%\) is competitive with the single\-class LP optimum \(66–92%\) and the reservation\-respecting LP \(66–93%\), and ahead of the two\-class LP and proportional baselines, but it does not top the table on this axis\. Two allocators report higher high\-priority ranges, and neither is a free lunch\. Divide\-by\-breach reports the highest range \(75–98%\), but only as an artifact of gross over\-allocation: it hands almost every region far more capacity than the budget permits, which serves high\-priority demand well in simulation but corresponds to exactly the downstream\-overload condition the system exists to prevent \(its 7% utilization quantifies the over\-allocation\), so we treat it as a cautionary reference, not a target\. Weighted max\-min reports 66–95% and does respect the budget, but it buys the extra high\-priority service by pulling capacity out of the best\-effort class below the balanced reservation split, a stronger priority policy rather than a strict improvement; we quantify that tradeoff in Section[V\-E2](https://arxiv.org/html/2608.07747#S5.SS5.SSS2)\. The served range is wide because contention varies by scenario; the lower end \(66%\) is the distributed scenario where demand greatly exceeds capacity everywhere, and the upper end \(93%\) is the pulse\-wave scenario\. Fairness is reported to two decimals; the demand\-weighted Jain’s index for the demand\-aware allocators is 0\.94–0\.99, discussed in Section[V\-E5](https://arxiv.org/html/2608.07747#S5.SS5.SSS5)\. The utilization column is the subject of the next subsection\.

#### V\-E1Utilization

Figure[1](https://arxiv.org/html/2608.07747#S5.F1)shows system\-wide capacity utilization, the fraction of allocated capacity matched by demand across both classes\. Our algorithm reaches 100% across all scenarios, the LP allocators and proportional sit near 97%, static uniform at 65%, and divide\-by\-breach at 7%\. The adaptive algorithm reaches 100% because both of its levels are demand\-driven: the inter\-class step refuses to leave one class’s capacity idle while the other class has unmet demand, and the intra\-class step does the same across regions\. The remaining 3% gap to the LP allocators arises because the LP baselines recompute a static per\-cycle optimum and can leave small residuals when demand shifts within a cycle\.

We are deliberately not making utilization the headline result, because high utilization is necessary but not sufficient: an allocator can be fully utilized while serving the wrong demand\. Divide\-by\-breach sits at the opposite extreme, its 7% utilization quantifies the gross over\-allocation \(handing most regions the full budget\) that overwhelms the shared downstream resource, the very failure mode the system is built to prevent\. Utilization is best read as a guardrail \(our algorithm wastes no capacity and never over\-commits\) rather than as the measure of merit\. This full\-utilization guarantee is conditional: it holds when aggregate demand meets or exceeds the budget, so that there is enough demand to cover the conserved capacity\. All 8 scenarios are oversubscribed by construction \(total demand exceeds the budget\), which is the regime the system is built for; when aggregate demand falls below the budget no budget\-respecting allocator can reach 100%, because the demand shortfall is idle by definition\. The measure of merit is high\-priority demand served, which we turn to next\.

![Refer to caption](https://arxiv.org/html/2608.07747v1/fig1_utilization.png)Figure 1:System\-wide capacity utilization across 8 contention scenarios\. The proposed algorithm wastes no capacity \(100%\) without over\-committing; divide\-by\-breach’s 7% reflects gross over\-allocation that overwhelms the shared downstream resource\.
#### V\-E2High\-Priority Demand Served

High\-priority demand served is the metric that matters, and it is measured on the class that carries the contending load: when contending load \(in the CDN instantiation, application\-layer attack traffic indistinguishable from legitimate requests\) shares the high\-priority class, genuine high\-priority demand and contending load compete for the same allocation, and a region’s high\-priority service is its proportional share of what its allocation can cover\. Figure[2](https://arxiv.org/html/2608.07747#S5.F2)shows the result across all scenarios\.

The proposed algorithm serves 66–93% of high\-priority demand depending on scenario severity\. It is competitive with the single\-class LP optimum \(66–92%\) and the reservation\-respecting LP \(66–93%\), and ahead of proportional \(55–90%\)\. Static uniform trails everything \(59–69%\) because it ignores demand: a region with a large share of high\-priority demand receives the same1/221/22slice as an empty one\. The reservation\-respecting LP is worth reading as the optimal reference for what the proposed algorithm does: it guarantees each class its within\-reservation floor and then pools the surplus optimally\. In six of eight scenarios that surplus is zero under contention \(each class’s demand alone exhausts its reservation\), so it coincides with the single\-class LP; where a class is under\-subscribed it pulls ahead, most visibly on pulse\-wave \(93\.2% versus the single\-class LP’s 91\.8%\)\. The proposed algorithm is within a point of it in three scenarios and beats it in three others \(asymmetric by 2\.5 points, distributed and diurnal by under a point\), while trailing by up to 6\.1 points in the worst case \(a concentrated single\-region attack, where the reservation\-respecting LP’s global surplus placement beats the proposed algorithm’s proportional redistribution\), all while using no solver and carrying no per\-cycle state\.

The most informative comparison is with the two\-class LP \(55–91%\), the throughput optimum for the full problem\. The proposed algorithm serves*more*high\-priority demand than this optimum in most scenarios \(five of eight\), and the direction of the effect, not the exact count, is the point\. This is not a contradiction; it exposes a mismatch of objectives\. The two\-class LP maximizes total served load across both classes, so when the best\-effort class is saturated with contending load, the LP pours capacity into serving that load because doing so raises total throughput\. Our allocator instead holds capacity in proportion to per\-class demand and reservation, which under contention keeps more capacity on the high\-priority class\. The lesson is narrower than a blanket ranking:*when the objective is protecting high\-priority service under contention, maximizing total throughput can work against that goal*\. An allocator that maximizes total served load can serve less high\-priority demand than a demand\-proportional one, because the optimizer cannot tell that some of the load it is serving is the contention itself\. We show this directionally \(in five of eight scenarios\), not as a universal ordering\. A demand\-aware, reservation\-respecting allocator avoids that trap by construction\. The reservation\-respecting LP makes this sharp: it is the throughput optimum*subject to*the per\-class floor, and it serves at least as much high\-priority demand as the unconstrained two\-class LP in all eight scenarios \(by up to 10\.3 points, on the distributed scenario\), so the effect is a property of the objective and the reservation constraint, not of our particular heuristic\. We are explicit that the effect is directional rather than uniform: in the remaining scenarios the throughput optimum serves more, and in the most adverse case \(a concentrated single\-region attack\) it leads our allocator by 5\.5 points, so the takeaway is the existence and cause of the objective mismatch, not a clean sweep\. These per\-scenario differences are well outside seed noise: the paired per\-seed gap against the two\-class LP ranges from\+12\.0\+12\.0points \(asymmetric\) to−5\.5\-5\.5points \(concentrated\), each with a 95% confidence interval narrower than±0\.3\\pm 0\.3points across the 5 seeds, so the wins and the losses are both real rather than sampling artifacts\.

Weighted max\-min fairness serves more high\-priority demand than the proposed algorithm in seven of eight scenarios \(by 4\.2 points on average across those seven, up to 8\.9 on the concentrated attack\), but this is a policy difference, not a strict improvement, and reading only the high\-priority column hides it\. Weighted max\-min caps how much any single cell can draw atλ​wc\\lambda w\_\{c\}, which under a concentrated attack limits the capacity the attacked high\-priority cells can pull and so protects the rest, but it funds that protection by driving the best\-effort class below the balanced reservation split\. On the concentrated attack it serves 89\.4% of high\-priority demand against our 80\.5%, while its best\-effort service falls to 30\.5% against our 40\.8%; the same pattern holds on rotating \(best\-effort 34\.4% versus 44\.3%\) and four\-region \(35\.7% versus 44\.2%\)\. The proposed algorithm and the reservation\-respecting LP hold best\-effort service at an identical level in every scenario, with the single\-class LP matching them in seven of eight \(it leaves a small residual only on pulse\-wave\), because all three respect the reservation split; weighted max\-min sits below them and the throughput\-maximizing two\-class LP sits above them\. Which point on that spectrum is correct is a deployment choice about how hard to prioritize the protected class at the expense of the other, not a question this evaluation settles\. We report weighted max\-min to make the choice explicit and to show that the proposed algorithm occupies the reservation\-respecting middle, matching the LP references on best\-effort service while using no solver\.

We do not claim the top of the table\. Divide\-by\-breach reports the highest high\-priority range \(75–98%\), but only by over\-allocating so severely \(7% utilization\) that it would overwhelm the shared downstream resource in deployment, which is the problem statement of this paper, not a solution to it\. Weighted max\-min reports the next highest \(66–95%\) by trading away best\-effort service as just described\. Among the allocators that both respect the capacity budget and hold the reservation split, the proposed algorithm, the reservation\-respecting LP, and the single\-class LP lead on high\-priority service, and the proposed algorithm alone does so with no solver, no per\-cycle state, and full utilization\.

![Refer to caption](https://arxiv.org/html/2608.07747v1/fig5_legit_served.png)Figure 2:High\-priority demand served during the contention phase across all eight scenarios\. The proposed algorithm is competitive with the single\-class LP optimum and serves more than the throughput\-optimal two\-class LP in most scenarios, because maximizing total throughput can mean serving the contending load at the expense of high\-priority demand\.
#### V\-E3Bursty Load: where inter\-class borrowing earns its place

The pulse\-wave scenario is where the two\-level design shows a clear, isolated benefit\. Our algorithm serves 93\.1% of high\-priority demand, against 91\.8% for the single\-class LP and 90\.7% for the two\-class LP\. To confirm this advantage comes from inter\-class borrowing specifically, and not from the intra\-class redistribution that the baselines also approximate, we ran an ablation: the same algorithm with the inter\-class step disabled \(intra\-class only\), realized as a registered variant of the allocator and run through the identical experiment harness\. The ablated version serves 91\.6%, the full algorithm 93\.1%, so the entire 1\.5\-point gain is attributable to inter\-class borrowing\. This gain is stable across seeds: over the 5 seeds the paired per\-seed difference is\+1\.49\+1\.49points \(95% CI\[1\.47,1\.51\]\[1\.47,1\.51\], pairedtt\-test\), far outside seed noise\. Across the other seven scenarios the same ablation changes high\-priority service by 0\.1 point or less, so the mechanism is neutral away from bursty load\.

The gain is also not an artifact of the pulse scenario’s chosen contention split\. The split between the two classes within the excess load is a scenario parameter \(the fraction of attack volume that lands in the high\-priority class\), and pulse fixes it at 0\.2\. Sweeping that fraction from 0\.0 to 0\.8 on the pulse scenario, the inter\-class borrowing gain is a flat\+1\.49\+1\.49points at every value, rising only at the degenerate end where nearly all excess is high\-priority \(\+1\.86\+1\.86points at 0\.9,\+4\.05\+4\.05points at 1\.0\)\. The same sweep on the two non\-bursty scenarios \(distributed and four\-region\) yields essentially no gain across 0\.0 to 0\.8 \(exactly 0\.00 points through 0\.6, and under 0\.1 point at 0\.8\), and spikes only at the same degenerate split of 1\.0, in fact higher there than pulse \(\+8\.6\+8\.6points on distributed and\+6\.1\+6\.1points on four\-region\), because at that corner all excess is high\-priority and nothing remains in the best\-effort class to contend, so borrowing is pathological for every scenario alike\. That all three scenarios spike at the split of 1\.0 confirms the corner is an artifact of the pathological all\-high\-priority split, not evidence about burstiness\. Across the realistic 0\.0 to 0\.8 range the benefit tracks temporal burstiness, not a hand\-picked contention split: it holds across the full range of splits on the bursty scenario and is absent across the same range on the stationary ones\.

The mechanism is temporal\. During each off\-peak window, best\-effort demand drops, freeing capacity; inter\-class borrowing reclaims it for the high\-priority class for the duration of the lull, then returns it when the next burst arrives\. A per\-cycle optimizer, single\-class or two\-class, recomputes from the current demand each cycle and has no notion of holding or returning capacity across the cycle, so it cannot capture this gain\. This is the honest core of the contribution: inter\-class elastic borrowing helps high\-priority service specifically under temporally bursty load, and is neutral, neither helping nor hurting, when demand is stationary\.

#### V\-E4Convergence

Figure[3](https://arxiv.org/html/2608.07747#S5.F3)shows convergence behavior\. Our algorithm, both LPs, and static uniform settle in a single iteration in every scenario, because each recomputes allocations from the current demand and a fixed base reservation without feeding the previous cycle’s output back as input\. Computing from current demand is necessary but not sufficient for one\-step settling: the proportional baseline also recomputes from scratch each cycle, yet on the distributed scenario it never settles \(green bar, 59 iterations\), because it passes per\-region demand straight through with no reservation floor or damping\. When the attack spreads large, noisy demand across all 22 regions at once, the per\-region shares jitter with the±30%\\pm 30\\%demand noise and the largest single\-region reallocation stays above the 5% convergence threshold from one cycle to the next\. The proposed algorithm avoids this because it reallocates only the surplus or deficit relative to the fixed reservation base, which bounds the per\-cycle movement and damps the demand noise rather than tracking it\. This is the same failure mode as divide\-by\-breach reaching it by a different route \(proportional tracks noise linearly; divide\-by\-breach jumps discontinuously as regions cross the over\-limit threshold\), and it is exactly the instability the one\-step\-stabilization result rules out for our allocator\.

Divide\-by\-breach fails to stabilize under distributed attacks \(shown as \-1 in the data\)\. The cause is not a feedback loop, the over\-limit set is determined entirely by exogenous per\-region demand against a fixed threshold, and does not depend on the previous allocation\. Rather, the allocation is a discontinuous function of the over\-limit count: each region that crosses the threshold changes the divisor, which shifts every region’s budget at once\. Under a distributed attack many regions sit near the threshold, so per\-cycle demand noise repeatedly pushes them across it, the count fluctuates, and the allocation never settles\. Under slow\-ramp attacks the over\-limit set instead grows monotonically as the ramp proceeds, adding regions one at a time, which is why stabilization tracks the ramp duration rather than oscillating\. The proposed algorithm avoids both behaviors because its allocation is a continuous, demand\-proportional function of the current demand vector\.

![Refer to caption](https://arxiv.org/html/2608.07747v1/fig2_convergence.png)Figure 3:Convergence iterations\. Two baselines fail to settle under the distributed scenario\. Divide\-by\-breach \(orange\) never settles because demand noise repeatedly moves near\-threshold regions in and out of the over\-limit set, shifting the divisor each cycle\. The proportional baseline \(green\) spikes to 59 iterations because it tracks the±30%\\pm 30\\%per\-region demand noise directly, with no reservation floor to damp it, so the largest per\-region share keeps moving by more than the 5% threshold\. The proposed algorithm, both LPs, and static uniform settle in one iteration in every scenario\.
#### V\-E5Fairness Under Scarcity

Figure[4](https://arxiv.org/html/2608.07747#S5.F4)shows demand\-weighted fairness over time during a rotating attack, measured as Jain’s index over per\-region satisfaction ratios \(high\-priority demand served divided by high\-priority demand\)\. The takeaway of this subsection is narrow and we state it as such: among the budget\-respecting allocators, fairness is*not*a distinguishing axis\. The demand\-aware algorithms \(ours, all three LPs, weighted max\-min, and proportional\) all hold the index in a narrow band, effectively tied, because each routes capacity toward demand and so equalizes satisfaction ratios across regions by construction\. Our algorithm stays between 0\.97 and 0\.99 across every scenario; the band widens to 0\.94–0\.99 once the two\-class LP is included, whose floor of 0\.94 on the distributed scenario is the one demand\-aware outlier\. The two new baselines fall inside this band \(weighted max\-min 0\.96–0\.99, the reservation\-respecting LP 0\.96–0\.99\), so adding them does not change the conclusion that fairness is not a distinguishing axis among budget\-respecting allocators\. The one allocator that does separate is static uniform, which sits near 0\.95 because it ignores demand entirely and persistently under\-serves high\-traffic regions relative to quiet ones\. The index does not reach exactly 1 because demand is discrete and carries per\-region noise, and because under contention some regions are more contended than others; the small oscillations in the figure are these per\-cycle adjustments, not a drift away from fairness\. We include fairness to show the proposed algorithm gives up nothing on this axis, not as a dimension on which it wins\.

![Refer to caption](https://arxiv.org/html/2608.07747v1/fig3_fairness_timeseries.png)Figure 4:Demand\-weighted fairness during rotating attack, y\-axis scaled to \[0\.8, 1\.0\]\. The demand\-aware allocators are effectively tied between 0\.97 and 0\.99; only static uniform separates, penalizing high\-traffic regions near 0\.95\.
#### V\-E6Utilization Over Time

Figure[5](https://arxiv.org/html/2608.07747#S5.F5)shows system\-wide utilization over time during a concentrated single\-region attack\. Our algorithm holds at 100% throughout, while the other budget\-respecting allocators dip slightly in low\-demand phases of the diurnal cycle, where a class’s demand falls below its reservation and the single\-class methods leave the difference idle\. This is the guardrail property discussed above, and it holds under contention \(aggregate demand at or above the budget\): the proposed algorithm never leaves capacity idle while unmet demand exists elsewhere, and never over\-commits\. We stress that this efficiency is not by itself the contribution, it is a precondition; the high\-priority\-service results above are what distinguish the allocators\.

![Refer to caption](https://arxiv.org/html/2608.07747v1/fig4_utilization_timeseries.png)Figure 5:System\-wide utilization over time during concentrated attack\. The proposed algorithm sustains 100% while the other budget\-respecting allocators leave small residuals idle during low\-demand phases\.

## VICounting\-Pipeline Validation

We validated the end\-to\-end counting and control pipeline of the CDN instantiation in a 5\-region prototype deployment running on Docker\. This experiment exercises the data path that feeds the allocator, namely per\-pod counting, hierarchical aggregation, and cross\-region transport\. It does not by itself validate the allocation decisions, which are evaluated in Section[V](https://arxiv.org/html/2608.07747#S5); we are explicit about that boundary below\. Each region contains a production\-equivalent Nginx proxy with the Rust counting module, an Envoy enforcer with WAF integration, a Local Control Plane \(LCP\) for per\-region aggregation, and a Redis instance\. A Central Management Plane \(CMP\) connects to all 5 LCPs via bidirectional gRPC streams\.

### VI\-ASetup

The deployment runs 42 containers across 5 isolated Docker networks \(one per region\) with uplink and client networks bridging them\. The Rust pod counter module runs inside each Nginx proxy, counting per\-domain requests using lock\-free atomics and flushing deltas to the LCP every second\.

Traffic is generated using curl through the proxy, with the full request path exercised: TLS termination, WAF evaluation, domain lookup from Redis, origin proxying, and response delivery\. Rate limits are enforced based on allocations pushed from the control plane\.

### VI\-BExperiment

We ran a 3\-phase experiment:

1. 1\.Peacetime \(30s\):20 RPS legitimate traffic distributed evenly across all 5 regions\.
2. 2\.Attack \(60s\):100 RPS concentrated on region\-a, with legitimate traffic continuing on all regions\.
3. 3\.Recovery \(30s\):Attack stops, observe allocation return to baseline\.

### VI\-CResults

We logged per\-region aggregated request counts \(RPM\) at the CMP\. The data shows clear attack concentration and recovery:

During peacetime, all regions report approximately equal counts\. When the attack begins, the targeted region’s count rises well above the others while they remain at baseline\. After the attack stops, the targeted region returns to baseline\. The captured counts reflect the load the testbed sustained through the full proxy path rather than the nominal offered rate, and the logging cadence in this run averaged roughly one sample per minute rather than the 10\-second control cadence; reconciling the prototype’s logging units and cadence with the control plane is left to future hardening\.

The LCPs tracked per\-domain counters across all 5 regions, the CMP maintained gRPC connections to all clusters, and the counting pipeline \(Rust FFI in Nginx, flush to LCP, aggregation at CMP\) operated without errors throughout the experiment\.

This demonstrates that the counting and aggregation pipeline, from pod\-level atomic counting through hierarchical aggregation to the central plane, functions correctly with real HTTP traffic and production\-grade proxy infrastructure\. We do not claim it validates the allocation algorithm itself: the prototype logged input counts but not the allocations, rate limits, or served\-traffic outcomes that would be needed to evaluate allocation decisions in deployment\. Closing that gap, by logging allocator output and served traffic in the testbed, is the natural next step\.

## VIIRelated Work

Fair resource allocation\.Weighted fair queueing\[[6](https://arxiv.org/html/2608.07747#bib.bib6)\]and its variants provide per\-flow fairness at a single network element, and proportional share scheduling offers similar guarantees for CPU and memory\. Dominant Resource Fairness\[[7](https://arxiv.org/html/2608.07747#bib.bib7)\]generalizes max\-min fairness to users with heterogeneous demands over multiple resource*types*; our problem is different in shape, a single conserved resource shared across locations and two priority classes, but DRF’s lesson that the fairness objective must match the structure of demand carries over, and we include a weighted max\-min baseline in the DRF style in our evaluation \(Section[V\-E2](https://arxiv.org/html/2608.07747#S5.SS5.SSS2)\), where it serves more high\-priority load than the proposed algorithm precisely by weighting the protected class more aggressively at the expense of the best\-effort class\. Our contribution is applying fairness principles to a two\-dimensional problem \(locations×\\timestwo service classes\) with the additional constraint that total capacity must be strictly conserved, and identifying that a throughput\-maximizing objective is the wrong one when one class carries contending load\. This positioning is stated for the general allocation problem; the DDoS setting is the instantiation in which we evaluate it\.

The water\-filling algorithm from information theory provides the theoretical optimum for single\-dimensional allocation, and our three LP baselines implement it for the single\-class, reservation\-respecting, and pooled two\-class cases respectively\. The two\-class LP is the throughput optimum for the full problem, so our algorithm cannot beat it on total served load within a cycle\. The interesting gap is on*high\-priority*demand, where our demand\-proportional allocator can exceed the throughput optimum precisely because the latter spends capacity on contending load to maximize total throughput; the reservation\-respecting LP confirms this is a property of the objective under a per\-class floor, not of our heuristic\.

Centralized capacity allocation in production systems\.The closest systems to our setting are the centralized bandwidth allocators of production wide\-area networks\. SWAN\[[8](https://arxiv.org/html/2608.07747#bib.bib8)\]centrally decides how much each service may send, allocating higher\-priority classes first with weighted max\-min fairness within each class; BwE\[[9](https://arxiv.org/html/2608.07747#bib.bib9)\]allocates WAN bandwidth hierarchically across services with mixed guaranteed and best\-effort classes\. Both solve a richer problem than ours \(multiple paths, many services, bandwidth functions\) with correspondingly heavier machinery, and neither faces our defining constraint that part of the observed demand may be adversarial load the allocator should not maximize\. Taiji\[[10](https://arxiv.org/html/2608.07747#bib.bib10)\]manages global user traffic from edge nodes to data centers to balance utilization; it routes demand to capacity, whereas we distribute capacity to demand under a conserved budget\. Our algorithm occupies a deliberately simpler point: two classes, one budget, solver\-freeO​\(K​N\)O\(KN\)proportional redistribution with provable conservation\.

DDoS defense at the CDN edge \(the evaluated instantiation\)\.Surveys of DDoS defense in cloud environments\[[11](https://arxiv.org/html/2608.07747#bib.bib11)\]catalog the detection and mitigation landscape; the question we study, how to distribute a fixed capacity budget across locations while an attack is being absorbed, sits downstream of that landscape and is comparatively unaddressed\. Alcoz et al\.\[[1](https://arxiv.org/html/2608.07747#bib.bib1)\]proposed aggregate\-based congestion control for pulse\-wave DDoS attacks using P4 programmable switches\. Their system infers attack patterns via online clustering and applies per\-packet rate limiting on Intel Tofino hardware\. This operates at L3/L4 per\-flow granularity, which is complementary to our per\-domain geographic allocation\. We address the higher\-level question of how to distribute a domain’s capacity budget across regions\.

Recent work on coordinated cloud\-edge DDoS scrubbing\[[2](https://arxiv.org/html/2608.07747#bib.bib2)\]addresses predictive resource coordination between scrubbing centers and edge locations\. Their focus is on deciding when to activate scrubbing \(a binary decision\), while we address how to continuously redistribute a fixed capacity budget across many locations during an ongoing attack\.

Detection across distributed domains\.Chen et al\.\[[3](https://arxiv.org/html/2608.07747#bib.bib3)\]address collaborative detection of DDoS attacks across multiple network domains, correlating change\-point signals between domains to identify attacks earlier than any single vantage point; more recent detection work spans programmable data planes\[[13](https://arxiv.org/html/2608.07747#bib.bib13)\], graph neural networks\[[14](https://arxiv.org/html/2608.07747#bib.bib14)\], and distributed SDN\-based prediction at the edge\[[5](https://arxiv.org/html/2608.07747#bib.bib5)\]\. All of this targets the detection problem, identifying that an attack is underway, which is upstream of and complementary to the allocation problem we study: we take detection and class labels as inputs and decide how to distribute a fixed capacity budget across locations once contention is recognized\.

Allocation and defense under attack\.Kumar and Bhuyan\[[4](https://arxiv.org/html/2608.07747#bib.bib4)\]applied game theory to defend elastic and inelastic services against DDoS, modeling the interaction between attacker and defender as a two\-player game\. Their work provides theoretical bounds but does not address the practical problem of geographic distribution or per\-class capacity sharing\.

Cooperative DDoS defense across edge and cloud environments has been studied in\[[5](https://arxiv.org/html/2608.07747#bib.bib5)\], but this work focuses on detection coordination rather than capacity allocation\.

CDN resource management\.Content placement and request routing in CDNs is well\-studied, from the classical survey of Pallis and Vakali\[[12](https://arxiv.org/html/2608.07747#bib.bib12)\]to production\-scale edge traffic management\[[10](https://arxiv.org/html/2608.07747#bib.bib10)\], but these systems optimize for latency, cache hit rates, and utilization balance, not for defending a fixed capacity budget under contention\. Our evaluation is specific to the attack scenario where a domain’s capacity budget must be defended across regions while maintaining service for legitimate users; the allocation model itself is not\.

Traffic classification for DDoS\.Signature\-based classification\[[13](https://arxiv.org/html/2608.07747#bib.bib13)\]and deep learning approaches\[[14](https://arxiv.org/html/2608.07747#bib.bib14)\]focus on the detection problem: identifying which traffic is malicious\. We take classification as input and address the resource allocation problem that follows: given labeled demand, how to distribute limited capacity fairly\.

## VIIIDiscussion and Limitations

Generality beyond the evaluated instantiation\.We evaluated the algorithm on CDN capacity defense because that is the problem that motivated it and the one for which we have a deployment and a calibrated traffic model\. Nothing in the algorithm, its invariants, or its convergence result depends on the contending load being adversarial\. The model is a conserved budget shared across locations and two priority classes, with demand that is skewed across locations and time\-varying; any setting matching that shape is a candidate, for example splitting a fixed egress or database\-connection budget across data centers between latency\-critical and batch workloads, or sharing a licensed throughput cap across tenants between a premium and a standard tier\. Two properties travel directly: conservation holds by construction for any non\-negative demand \(Theorems 1–3\), and the inter\-class borrowing benefit appears wherever one class’s demand is temporally bursty so that it frees capacity the other class can use during lulls\. Two properties are instantiation\-specific and would need re\-checking elsewhere: the concrete concentration of demand across locations \(a parameter of our traffic model\) and the existence of a meaningful priority split between the two classes \(if both classes are equally critical, the inter\-class step still conserves capacity but the “protect the high\-priority class” framing no longer applies\)\. We do not claim to have validated these other instantiations; we claim the model is not specific to DDoS and identify what a port would have to verify\.

Information staleness\.The algorithm operates on demand observations that are 10\-20 seconds old in our deployment, due to the hierarchical aggregation pipeline \(Section[IV](https://arxiv.org/html/2608.07747#S4)\)\. Under demand patterns that shift faster than the observation delay, allocations will lag behind reality\. In our deployment, the attacks we have observed evolve on the timescale of minutes rather than seconds, so the 10\-second decision cycle has been sufficient there; an instantiation with faster demand shifts would need a proportionally faster pipeline\. The CRDT\-based synchronization ensures that even under network partitions between locations, each location continues operating with the best available \(possibly stale\) information\.

Oscillation risk\.Because the algorithm is reactive \(it allocates based on observed demand\), there is a theoretical risk of oscillation: high demand at a location triggers allocation, which satisfies the demand, which reduces observed demand, which reduces allocation\. We argue analytically that this does not occur in our setting: high\-priority demand is persistent \(it does not vanish once served\) and excess best\-effort demand exceeds capacity \(so allocation never fully satisfies it\), so neither class’s observed demand collapses in response to being served\. Our property\-based tests exercise the single\-cycle invariants that underpin this argument \(exact conservation and non\-negativity across randomized demand vectors\); they do not model demand dynamics across cycles, so the absence of oscillation rests on the analytical argument above rather than on a multi\-cycle experiment\. A time\-series stability experiment over evolving demand is future work\.

Class\-assignment dependency\.The inter\-class borrowing mechanism depends on demand being assigned to the right class\. If a large share of high\-priority demand is mislabeled best\-effort, the high\-priority class will be undersized\. In the CDN instantiation the system degrades gracefully because the best\-effort class is rate\-limited rather than dropped, so mislabeled requests still get partial service, and as the classifier gains confidence they migrate back to the high\-priority class\. In a non\-adversarial instantiation the analogous risk is a misconfigured priority tag; the same graceful\-degradation argument applies as long as the best\-effort class is served rather than denied\.

Single\-budget scope\.The algorithm operates independently per conserved budget \(per domain in the CDN instantiation\)\. If several budgets share a deeper downstream resource, per\-budget allocation does not capture the cross\-budget contention\. Extending to coupled budgets is future work; in our deployment domains map to separate origin pools, so the budgets are genuinely independent\.

Cold start\.When a budget first comes under contention with no prior allocation history, the algorithm starts from a uniform distribution and adapts within 1\-2 cycles\. During this cold\-start window \(up to 20 seconds in the CDN instantiation\), some high\-priority demand may be denied at heavy\-demand locations\. This is acceptable given the alternative of no adaptation at all\.

## IXConclusion

We presented a two\-level algorithm for allocating a conserved capacity budget across many locations and two service classes\. The algorithm combines intra\-class redistribution across locations with inter\-class elastic borrowing between classes, maintains conservation and fairness invariants, runs inO​\(K​N\)O\(KN\)time, and reaches a stable allocation in a single iteration under stationary demand because it carries no per\-cycle state\. We evaluated it on the instantiation that motivated it, defending a CDN’s per\-domain budget under volumetric attack, across 8 contention scenarios on a 22\-location topology, with contending load measured in the class it targets; there it serves high\-priority demand competitively with a single\-class LP optimum while never over\-committing the budget\.

Two findings are worth carrying forward, and both are about the problem rather than the application\. First, a throughput\-maximizing objective is the wrong objective under contention: a two\-class LP that maximizes total served load serves less high\-priority demand than our demand\-proportional allocator in most scenarios, because it cannot distinguish high\-priority load from the contending load it is also serving\. A demand\-aware allocator that respects per\-class reservations avoids this by construction\. Second, the added complexity of inter\-class borrowing earns its place specifically under temporally bursty load: an ablation, realized as a registered allocator variant and run through the same harness, shows it improves high\-priority service under pulse\-wave load and is neutral \(0\.1 point or less\) under stationary demand\. We would rather state plainly where the mechanism helps and where it does not than claim a uniform advantage the data does not support\. Validating the algorithm in further instantiations beyond CDN defense, capturing classifier dynamics in the evaluated one, and validating allocation decisions \(not only the counting pipeline\) in deployment, are the natural next steps\.

## References

- \[1\]A\. Gran Alcoz, M\. Strohmeier, V\. Lenders, and L\. Vanbever, “Aggregate\-Based Congestion Control for Pulse\-Wave DDoS Defense,” in*Proc\. ACM SIGCOMM*, 2022\.
- \[2\]R\. Zhou, Y\. Zeng, L\. Jiao, Y\. Zhong, and L\. Song, “Online and Predictive Coordinated Cloud\-Edge Scrubbing for DDoS Mitigation,”*IEEE Trans\. Mobile Computing*, vol\. 23, no\. 10, pp\. 9208–9223, 2024\.
- \[3\]Y\. Chen, K\. Hwang, and W\.\-S\. Ku, “Collaborative Detection of DDoS Attacks over Multiple Network Domains,”*IEEE Trans\. Parallel and Distributed Systems*, vol\. 18, no\. 12, pp\. 1649–1662, 2007\.
- \[4\]B\. Kumar and B\. Bhuyan, “Using Game Theory to Defend Elastic and Inelastic Services Against DDoS Attacks,” in*Lecture Notes in Networks and Systems*, Springer, 2022\.
- \[5\]H\. Zhou, Y\. Zheng, X\. Jia, and J\. Shu, “Collaborative Prediction and Detection of DDoS Attacks in Edge Computing: A Deep Learning\-Based Approach with Distributed SDN,”*Computer Networks*, vol\. 225, art\. 109642, 2023\.
- \[6\]A\. Demers, S\. Keshav, and S\. Shenker, “Analysis and Simulation of a Fair Queueing Algorithm,” in*Proc\. ACM SIGCOMM*, 1989\.
- \[7\]A\. Ghodsi, M\. Zaharia, B\. Hindman, A\. Konwinski, S\. Shenker, and I\. Stoica, “Dominant Resource Fairness: Fair Allocation of Multiple Resource Types,” in*Proc\. USENIX NSDI*, 2011, pp\. 24–37\.
- \[8\]C\.\-Y\. Hong, S\. Kandula, R\. Mahajan, M\. Zhang, V\. Gill, M\. Nanduri, and R\. Wattenhofer, “Achieving High Utilization with Software\-Driven WAN,” in*Proc\. ACM SIGCOMM*, 2013, pp\. 15–26\.
- \[9\]A\. Kumar*et al\.*, “BwE: Flexible, Hierarchical Bandwidth Allocation for WAN Distributed Computing,” in*Proc\. ACM SIGCOMM*, 2015\.
- \[10\]D\. Chou*et al\.*, “Taiji: Managing Global User Traffic for Large\-Scale Internet Services at the Edge,” in*Proc\. ACM SOSP*, 2019, pp\. 430–446\.
- \[11\]N\. Agrawal and S\. Tapaswi, “Defense Mechanisms Against DDoS Attacks in a Cloud Computing Environment: State\-of\-the\-Art and Research Challenges,”*IEEE Communications Surveys & Tutorials*, vol\. 21, no\. 4, pp\. 3769–3795, 2019\.
- \[12\]G\. Pallis and A\. Vakali, “Insight and Perspectives for Content Delivery Networks,”*Communications of the ACM*, vol\. 49, no\. 1, 2006\.
- \[13\]M\. Dimolianis, A\. Pavlidis, and V\. Maglaris, “Signature\-Based Traffic Classification and Mitigation for DDoS Attacks Using Programmable Network Data Planes,”*IEEE Access*, vol\. 9, pp\. 113061–113076, 2021\.
- \[14\]L\. Barsellotti, L\. De Marinis, F\. Cugini, and F\. Paolucci, “FTG\-Net: Hierarchical Flow\-to\-Traffic Graph Neural Network for DDoS Attack Detection,” in*Proc\. IEEE Int\. Conf\. High Performance Switching and Routing \(HPSR\)*, 2023, pp\. 173–178\.