A network-wide view-based detection and mitigation of a sophisticated Interest Flooding Attack

Abstract

Interest Flooding Attack (IFA) is one of the main security threats for the Named Data Networking (NDN). Most of its existing countermeasures enable intermediate routers near the attackers to independently detect the attack and consider the typical attack scenario in which attackers directly send malicious Interests at a constant and relatively high rate after the attack starts. Moreover, they may also throttle legitimate Interests when enforcing the existing defense measures at intermediate routers as it is still difficult for them to distinguish the Interests issued by attackers from those issued by legitimate consumers. Instead, this work aims at a more sophisticated attack scenario in which attackers start the attack at a relatively lower rate but gradually speed up to keep the Pending Interest Tables (PITs) of the victims increasing to finally deplete the PIT resources for legitimate consumers. It is relatively difficult for intermediate routers to independently and timely detect such a sophisticated IFA. To solve this problem, we propose a mechanism to detect and mitigate the sophisticated IFA from the network-wide view, dubbed as DMNWV. In DMNWV, a central controller monitors the network and makes a comprehensive and prompt decision on whether there is an ongoing IFA based on the overall state of the whole network collected from the abnormity information reports sent by the first-hop routers of attackers. Attack sources can be directly located after an IFA is determined, and then the routers directly connected to attackers (i.e., access routers) can take targeted measures based on the located attackers to prevent malicious Interest from entering the network without throttling legitimate Interests. We conduct an experimental study to evaluate the performance of DMNWV, explore the parameter settings of the attack detection algorithm at access routers, and measure the communication overhead of the central controller. The experimental results validate that DMNWV can timely detect and mitigate the sophisticated IFA without throttling requests from legitimate consumers with significantly low communication overhead of the central controller, which will not bring about too much burden to the network.