Link Flooding Attacks Research Articles

SARM: A network State-Aware Adaptive Routing Mutation method for power IoT

With the rapid development of Power Internet of Things (PIoT), the application of Internet of Things technology in smart grids is becoming increasingly widespread, but it also enlarges the attack surface of the system. Against this backdrop, traditional defense methods are limited by the asymmetry of network attack and defense, which makes it difficult to effectively resist the ievolving sniffing attacks and link flooding attacks. In order to improve the security of PIoT, this paper proposes an Adaptive Route Mutation based on Network State Awareness (SARM). It generates a route mutation space using a path state matrix and optimizes the time complexity of mutation space generation with a backtracking method. Furthermore, the SARM can dynamically adjust the route mutation strategy according to the real-time network state to realize self-adaptive defense. In conclusion, SARM is evaluated through simulations conducted with Mininet. Compared to Random Routing Mutation (RRM), it enhances defense against Sniffing and Distributed Denial of Service attacks by approximately 30% and 35% respectively. Additionally, in various example topologies, SARM consistently outperforms RRM.

Mitigating while accessing: A lightweight defense framework against link flooding attacks in SDN

Mitigating while accessing: A lightweight defense framework against link flooding attacks in SDN

A DDoS Tracking Scheme Utilizing Adaptive Beam Search with Unmanned Aerial Vehicles in Smart Grid

As IoT technology advances, the smart grid (SG) has become crucial to industrial infrastructure. However, SG faces security challenges, particularly from distributed denial of service (DDoS) attacks, due to inadequate security mechanisms for IoT devices. Moreover, the extensive deployment of SG exposes communication links to attacks, potentially disrupting communications and power supply. Link flooding attacks (LFAs) targeting congested backbone links have increasingly become a focal point of DDoS attacks. To address LFAs, we propose integrating unmanned aerial vehicles (UAVs) into the Smart Grid (SG) to offer a three-dimensional defense perspective. This strategy includes enhancing the speed and accuracy of attack path tracking as well as alleviating communication congestion. Therefore, our new DDoS tracking scheme leverages UAV mobility and employs beam search with adaptive beam width to reconstruct attack paths and pinpoint attack sources. This scheme features a threshold iterative update mechanism that refines the threshold each round based on prior results, improving attack path reconstruction accuracy. An adaptive beam width method evaluates the number of abnormal nodes based on the current threshold, enabling precise tracking of multiple attack paths and enhancing scheme automation. Additionally, our path-checking and merging method optimizes path reconstruction by merging overlapping paths and excluding previously searched nodes, thus avoiding redundant searches and infinite loops. Simulation results on the Keysight Ixia platform demonstrate a 98.89% attack path coverage with a minimal error tracking rate of 2.05%. Furthermore, simulations on the NS-3 platform show that drone integration not only bolsters security but also significantly enhances network performance, with communication effectiveness improving by 88.05% and recovering to 82.70% of normal levels under attack conditions.

SatShield: In-Network Mitigation of Link Flooding Attacks for LEO Constellation Networks

SatShield: In-Network Mitigation of Link Flooding Attacks for LEO Constellation Networks

Multi-Constraint and Multi-Policy Path Hopping Active Defense Method Based on SDN

Path hopping serves as an active defense mechanism in network security, yet it encounters challenges like a restricted path switching space, the recurrent use of similar paths and vital nodes, a singular triggering mechanism for path switching, and fixed hopping intervals. This paper introduces an active defense method employing multiple constraints and strategies for path hopping. A depth-first search (DFS) traversal is utilized to compute all possible paths between nodes, thereby broadening the path switching space while simplifying path generation complexity. Subsequently, constraints are imposed on residual bandwidth, selection periods, path similitude, and critical nodes to reduce the likelihood of reusing similar paths and crucial nodes. Moreover, two path switching strategies are formulated based on the weights of residual bandwidth and critical nodes, along with the calculation of path switching periods. This facilitates adaptive switching of path hopping paths and intervals, contingent on the network’s residual bandwidth threshold, in response to diverse attack scenarios. Simulation outcomes illustrate that this method, while maintaining normal communication performance, expands the path switching space effectively, safeguards against eavesdropping and link-flooding attacks, enhances path switching diversity and unpredictability, and fortifies the network’s resilience against malicious attacks.

Early Prevention and Mitigation of Link Flooding Attacks in Software Defined Networks

Software-Defined Networks (SDNs) are increasingly gaining prominence in the networking domain, enabling programmable control and management of network infrastructure within data centers. This programmability offers the advantage of dynamically adjusting the routing paths depending upon on the network’s requirements and capabilities. Computer networks have been vulnerable to denial of service attacks, particularly link flooding attacks, which have gained notoriety for their ability to isolate network segments precisely without affecting the rest of the network and evading detection. In this work, we introduce a security framework designed to prevent and mitigate link flooding attacks in Software Defined Networks. Our approach involves limiting the network reconnaissance probes used by attackers to gather knowledge about network topology. We prevent the attackers from obtaining an accurate network topology, limiting their ability to launch an attack. Our framework utilizes alternate paths and hop count manipulation to hinder the reconnaissance process. To further strengthen our claims, we evaluate our framework on real world topologies from the Topology Zoo dataset. Our analysis demonstrates that the majority of real world topologies already exhibit network path diversity and along with TTL manipulation we can hinder the mapping process, causing the attacker to infer an incorrect network topology.

Research on the reliability of bloom filters to defend a distributed denial-of-service

Distributed denial of service (DDoS) attacks are one of the threats to network security, and reasonable means of defense are sought. Bloom filter is a commonly used detection method, the research have listed different attacks in the paper and made it possible to compare it with other detection methods by analyzing how Bloom filter works. The research shows that the Bloom filter works by comparing the element to be queried with an already stored vector. If the query result is zero then the element does not exist, if it is one then it means that in most cases the element exists, but false positives are not excluded causing the element to be judged as existing. In this paper, the comparison with other methods also needs focus, the time complexity of inserting, searching, and deleting data is an important feature to consider when Bloom filters outperform other methods. The research also shows that the Bloom filter is to some extent better than other detection methods in terms of insertion, search, and deletion time. At the same time, the research showed that the use of Bloom filters in response to DDoS attacks is also very impressive, for the detection of link flooding attacks and the detection and processing speed of packets is commendable, can take up less memory to achieve better results.

RL-Shield: Mitigating Target Link-Flooding Attacks Using SDN and Deep Reinforcement Learning Routing Algorithm

Link-flooding attacks (LFAs) are a new type of distributed denial-of-service (DDoS) attacks that can substantially damage network connectivity. LFAs flows are seemingly legitimate at the origin. But their cumulative volume at critical links causes congestion. We propose RL-Shield, a reinforcement learning based defense system against LFAs. It mitigates LFAs and, at the same time, effectively forwards data traffic in the network. RL-Shield introduces a new detection algorithm for monitoring IP behaviors using the Dirichlet distribution and Bayesian statistics. It monitors the interplay of LFAs and traffic engineering and identifies source IPs that persistently react to re-routing events. The detection algorithm controls two reinforcement learning based routing algorithms that use a hop-by-hop technique to connect related node pairs.We evaluate RL-Shield on various network topologies by simulating several attack strategies. The simulation results demonstrate the effectiveness and high-accuracy of RL-Shield.

ReLFA: Resist link flooding attacks via renyi entropy and deep reinforcement learning in SDN-IoT

Link flooding attack (LFA) is a fresh distributed denial of service attack (DDoS). Attackers can cut off the critical links, making the services in the target area unavailable. LFA manipulates legal low-speed flow to flood critical links, so traditional technologies are difficult to resist such attack. Meanwhile, LFA is also one of the most important threats to Internet of things (IoT) devices. The introduction of software defined network (SDN) effectively solves the security problem of the IoT. Aiming at the LFA in the software defined Internet of things (SDN-IoT), this paper proposes a new LFA mitigation scheme ReLFA. Renyi entropy is to locate the congested link in the data plane in our scheme, and determines the target links according to the alarm threshold. When LFA is detected on the target links, the control plane uses the method based on deep reinforcement learning (DRL) to carry out traffic engineering. Simulation results show that ReLFA can effectively alleviate the impact of LFA in SDN IoT. In addition, the rerouting time of ReLFA is superior to other latest schemes.

Defending Against Link Flooding Attacks in Internet of Things: A Bayesian Game Approach

The link flooding attack (LFA) has emerged as a new category of distributed denial of service (DDoS) attacks in recent years. Along with the massive deployment of low-cost insecure Internet-of-Things (IoT) devices, the fast proliferation of IoT botnets dramatically increases the risk of LFAs. However, how to efficiently defend against LFAs in IoT still remains as an open problem. To overcome this challenge, we model the interaction between an LFA attacker and the network manager as a two-person Bayesian game in this article to precisely characterize the behaviors of both sides. Then, the rational behaviors of the attacker and the optimal strategies of the defender are unveiled by deriving the Bayesian Nash equilibrium (BNE). Inspired by the obtained BNEs, a cost-effective decision framework is proposed for the defender to make defense decisions. Furthermore, we numerically analyze the effect of all the related factors and present feasible suggestions to deter attack motivations fundamentally. Experimental results demonstrate that the proposed method not only consistently outperforms baseline methods in terms of the defender’s utilities under different attack intensities, but also is robust to the changes in important parameters, including the value of benign traffic and the latency of traffic scrubbing.

STOP: A Service Oriented Internet Purification Against Link Flooding Attacks

Internet purification is a necessary technique to defend against Distributed Denial-of-Service (DDoS) attack. It can help Internet Service Provider (ISP) to completely and precisely scrub attack traffic through establishing the sender-receiver pair based filtering rules in networks. However, when faced with the Link Flooding Attacks (LFA), a new kind of DDoS, existing relevant schemes suffer the drawbacks, including the weak willingness of defense cooperation between Autonomous Systems (ASes), lower filtering efficiency and poor robustness. For this, we propose STOP, a service-oriented Internet purification technique designed to defend against LFA. In STOP, malicious traffic filtering is viewed as a value-added service and each filter contributor (i.e., AS) can get some benefit from it. This helps ASes to strengthen the willing of defense cooperation. Moreover, we devise a filter recommendation algorithm to maximize the filtering efficiency, with minimum service cost and bandwidth damages. Furthermore, in the face of the strategic threats that aim to paralyze or bypass STOP, we devise relevant defense techniques to make it more robust. Through rigorous mathematical analysis and extensive experiments based on real-world topology, we demonstrate that compared with prior work, STOP increases the filtering efficiency by 12%.

Efficient Detection of Link-Flooding Attacks with Deep Learning

The DDoS attack is one of the most notorious attacks, and the severe impact of the DDoS attack on GitHub in 2018 raises the importance of designing effective defense methods for detecting this type of attack. Unlike the traditional network architecture that takes too long to cope with DDoS attacks, we focus on link-flooding attacks that do not directly attack the target. An effective defense mechanism is crucial since as long as a link-flooding attack is undetected, it will cause problems over the Internet. With the flexibility of software-defined networking, we design a novel framework and implement our ideas with a deep learning approach to improve the performance of the previous work. Through rerouting techniques and monitoring network traffic, our system can detect a malicious attack from the adversary. A CNN architecture is combined to assist in finding an appropriate rerouting path that can shorten the reaction time for detecting DDoS attacks. Therefore, the proposed method can efficiently distinguish the difference between benign traffic and malicious traffic and prevent attackers from carrying out link-flooding attacks through bots.

A Spatiotemporal-Oriented Deep Ensemble Learning Model to Defend Link Flooding Attacks in IoT Network.

(1) Background: Link flooding attacks (LFA) are a spatiotemporal attack pattern of distributed denial-of-service (DDoS) that arranges bots to send low-speed traffic to backbone links and paralyze servers in the target area. (2) Problem: The traditional methods to defend against LFA are heuristic and cannot reflect the changing characteristics of LFA over time; the AI-based methods only detect the presence of LFA without considering the spatiotemporal series attack pattern and defense suggestion. (3) Methods: This study designs a deep ensemble learning model (Stacking-based integrated Convolutional neural network–Long short term memory model, SCL) to defend against LFA: (a) combining continuous network status as an input to represent “continuous/combination attacking action” and to help CNN operation to extract features of spatiotemporal attack pattern; (b) applying LSTM to periodically review the current evolved LFA patterns and drop the obsolete ones to ensure decision accuracy and confidence; (c) stacking System Detector and LFA Mitigator module instead of only one module to couple with LFA detection and mediation at the same time. (4) Results: The simulation results show that the accuracy rate of SCL successfully blocking LFA is 92.95%, which is 60.81% higher than the traditional method. (5) Outcomes: This study demonstrates the potential and suggested development trait of deep ensemble learning on network security.

On Modeling Link Flooding Attacks and Defenses

The increasing popularity of Internet of Things (IoTs) is making people universally connected and thus bringing the ease of life. Because of their sheer volume, weak security, and continual operation, IoT devices, along with many computer servers, are widely compromised to launch powerful distributed denial-of-service (DDoS) attacks. The emerging link flooding attacks (LFAs) are one type of such attacks that attract significant attention in both academia and industry against the routing infrastructure. The attack traffic flows originating from bots (e.g., compromised IoT devices) are deliberately aggregated at upstream critical links and grow intensified, gradually making a network connected to the critical links disconnected. Although LFAs are far more sophisticated than traditional DDoS attacks, whether such sophistication comes without a downside has never been investigated. In this paper, by modeling link flooding attacks and defenses, we tackle a series of questions concerning the practical issues of LFAs. Specifically, from the perspective of attacks, we advance a novel notion of strike precision, and reveal that LFAs may exhibit attack interference (i.e., unexpectedly interfere the connectivity of innocent networks) which might undermine the stealthiness and persistence of LFAs. From the perspective of defenses, we make the first step to study attack intention, i.e., inversely inferring the target network to disconnect based on the identified links under attack. Furthermore, we consider a strong defender who employs traffic engineering to mitigate LFAs, and formulate the game-theoretic interactions between attackers and defenders. Our formulation demonstrates that LFAs can be effectively mitigated based on traffic engineering from a game-theoretic perspective. We also study practical issues of non-cooperative defenses (e.g., light-weight probe deployment, multi-protocol-based measurement).

BottleNet: Hiding Network Bottlenecks Using SDN-Based Topology Deception

The robustness of a network’s connectivity to other networks is often highly dependent on a few critical nodes and links that tie the network to the larger topology. The failure or degradation to such network bottlenecks can result in outages that may propagate throughout the network. Unfortunately, the presence of the bottlenecks also offers opportunities for targeted link flooding attacks (LFAs) . Researchers have proposed a new and promising defense to counter LFAs, referred to as topology deception . This strategy centers on hindering the discovery of bottlenecks by presenting false trace responses to adversaries as they perform topological probing of the target network. Even though the goal of topology deception centers on obscuring critical links, node dependencies can be exploited by an adversary. However, current approaches do not consider a wide range of metrics that may reveal important and diverse aspects of network bottlenecks. Furthermore, existing approaches create a simple form of virtual topology, which is subject to relatively easy detection by the adversary, reducing its effectiveness. In this paper, we propose a comprehensive topology deception framework, which we refer to as BottleNet. Our suggested approach can analyze various network topology features both with respect to static and dynamic metrics and then use this information to identify bottlenecks, finally producing complex virtual topologies that are resilient to adversarial detection.

Strategic Defense Against Stealthy Link Flooding Attacks: A Signaling Game Approach

With the increasing diversity of Distributed Denial-of-Service (DDoS) attacks, it is becoming extremely challenging to design a fully protected network. For instance, Stealthy Link Flooding Attack (SLFA) is a variant of DDoS attacks that strives to block access to a target area by flooding a small set of links, and it is shown that it can bypass traditional DDoS defense mechanisms. One potential solution to tackle such SLFAs is to apply Moving Target Defense (MTD) techniques in which network settings are dynamically changed to confuse/deceive attackers, thus making it highly expensive to launch a successful attack. However, since MTD comes with some overhead to the network, to find the best strategy (i.e., when and/or to what extent) of applying it has been a major challenge. The strategy is significantly influenced by the attacker's behavior that is often difficult to guess. In this work, we address the challenge of obtaining the optimal MTD strategy that effectively mitigates SLFAs while incurs a minimal overhead. We design the problem as a signaling game considering the network defender and the attacker as players. A belief function is established throughout the engagement of the attacker and the defender during this SLFA campaign, which is utilized to pick the best response/action for each player. We analyze the game model and derive a defense mechanism based on the equilibria of the game. We evaluate the technique on a Mininet-based network environment where an attacker is performing SLFAs and a defender applies MTD based on equilibria of the game. The results show that our signaling game-based dynamic defense mechanism can provide a similar level of protection against SLFAs like the extensive MTD solution, however, causing a significantly reduced overhead.

Randomized Security Patrolling for Link Flooding Attack Detection

With the advancement of large-scale coordinated attacks, the adversary is shifting away from traditional distributed denial of service (DDoS) attacks against servers to sophisticated DDoS attacks against Internet infrastructures. Link flooding attacks (LFAs) are such powerful attacks against Internet links. Employing network measurement techniques, the defender could detect the link under attack. However, given the large number of Internet links, the defender can only monitor a subset of the links simultaneously, whereas any link might be attacked. Therefore, it remains challenging to practically deploy detection methods. This paper addresses this challenge from a game-theoretic perspective, and proposes a randomized approach (like security patrolling) to optimize LFA detection strategies. Specifically, we formulate the LFA detection problem as a Stackelberg security game, and design randomized detection strategies in consideration of the adversary's behavior, where best and quantal response models are leveraged to characterize the adversary's behavior. We employ a series of techniques to solve the nonlinear and nonconvex NP-hard optimization problems for finding the equilibrium. The experimental results demonstrate the necessity of handling LFAs from a game-theoretic perspective and the effectiveness of our solutions. We believe our study is a significant step forward in formally understanding LFA detection strategies.

Detecting and Mitigating Target Link-Flooding Attacks Using SDN

DDoS attacks have caused very serious damage to enterprise networks. Recently, a new kind of DDoS attack called link-flooding attack (LFA), has surfaced and is already being used by attackers to flood and congest network critical links. LFA is very difficult to detect since adversaries often utilize large-scale legitimate low-speed flows and rolls target links to isolate target areas for launching attacks. To address such a critical security problem, we design and implement a novel LFA defense system called LFADefender that leverages some key features, such as programmability, network-wide view, and flow traceability, of an emerging network technology, Software-Defined Networking (SDN), to effectively detect and migrate LFA. In LFADefender, we propose a LFA target link selection approach and design a LFA congestion monitoring mechanism to effectively detect LFA. In addition, we present a multiple optional paths rerouting method to temporarily mitigate links congestion caused by LFA. We further propose a malicious traffic blocking approach to radically mitigate LFA. Our evaluation results show that LFADefender can accurately detect and rapidly mitigate LFA, but only imposes minimal overhead in the communication channels between network controllers and data planes.

Tracing Link Flooding Attacks in MobilityFirst Networks

Current link flooding attack (LFA) defense strategies highly rely on static network topology and precollectedtraceroute record in current Internet, which are not fit for the MobilityFirst networks. Wepropose the traffic scanning defense (TSD) mechanism against LFA in MobilityFirst. TSD is cooperative,fast and stateless, and also scalable to implement in MFTP for MobilityFirst. Preliminary testsshow promising efficiency of TSD.

LinkScope: Toward Detecting Target Link Flooding Attacks

A new class of target link flooding attacks (LFAs) can cut off the Internet connections of a target area without being detected, because they employ legitimate flows to congest selected links. Although new mechanisms for defending against LFA have been proposed, the deployment issues limit their usage, since they require either additional modules to enhance routers or using the software-defined network to replace the traditional routers. In this paper, we propose a novel framework that employs both the end-to-end and hop-by-hop network measurement techniques to capture the abnormal path performance degradation for detecting LFA and then locate the target links or areas whenever possible, and develop a prototype of the framework named LinkScope . Although using network measurement to capture network anomaly is not new, we tackle a number of challenging issues, such as conducting large-scale Internet path monitoring via non-cooperative measurement so that users do not need to install LinkScope on every host, profiling the performance of asymmetric Internet paths and detecting LFA. The extensive evaluation in a testbed and the Internet shows that with limited bandwidth and computational overhead, LinkScope can achieve timely detection and diagnosis of LFA with high detection rate and low false positive rate.