Abstract:The emerging link flooding attacks (LFAs) are one type of attacks that attract significant attention in both academia and industry against the routing infrastructure. The attack traffic flows originating from bots (e.g., compromised IoT devices) are deliberately aggregated at upstream critical links and grow intensified, gradually making a network connected to the critical links disconnected. Although LFAs are far more sophisticated than traditional DDoS attacks, whether such sophistication comes without a downside has never been investigated. In this paper, by modeling link flooding attacks and defenses, we tackle a series of questions concerning the practical issues of LFAs. Specifically, from the perspective of attacks, we advance a novel notion of strike precision, and reveal that LFAs may exhibit attack interference (i.e., unexpectedly interfere the connectivity of innocent networks) which might undermine the stealthiness and persistence of LFAs. From the perspective of defenses, we make the first step to study attack intention, i.e., inversely inferring the target network to disconnect based on the identified links under attack. Furthermore, we consider a strong defender who employs traffic engineering to mitigate LFAs, and formulate the game-theoretic interactions between attackers and defenders. The experiment results show that attack interference is pervasive, and our proposed SPAH flooding strategy can substantially lower attack interference and increase strike precision. Moreover, we demonstrate that LFAs can be effectively mitigated based on traffic engineering from a game-theoretic perspective, wherein the defender can adopt non-cooperative measurement techniques to achieve light-weight and multi-protocol-based robust probe deployment.

An active defense model for Web Accessing DoS attacks

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

A DoS Attack Defense Model Adopting Data Mining

Defend Against Application-Layer Distributed Denial-of-Service Attacks Based on Session Suspicion Probability Model

Group Testing Based Detection of Web Service DDoS Attackers.

A Method Based on AMHI for DDoS Attacks Detection and Defense

Risk Assessment and Defense Resource Allocation of Cyber-Physical Distribution Systems under Denial-of-Service Attacks

Distributed Adaptive Consensus Control for Nonlinear Systems with Active-Defense Mechanism Against Denial-of-Service Attacks

Modeling User Browsing Activity for Application Layer DDoS Attack Detection.

An Active Cooperation Defense Model for Large Scale Network

A METHOD FOR DDoS ATTACKS PREVENTION BASED ON INTERACTION ACTIVITY

A DDOS PREVENTION MODEL BASED ON WAVELET ANALYSIS AND CONNECTION TRUST DOMAIN

Differential equations and the Bethe ansatz

Defending Against Denial of Service Attacks

Design and Implementation of Adaptive Intrusion Detection System Based on Web Access Behavior Relevancy

An Adaptive Control Mechanism for Mitigating Ddos Attacks

Anti-Attacking Modeling and Analysis of Cyberspace Mimic DNS

An Approach of Defending Against DDoS Attack

Research on an Effective Approach Against DDoS Attacks

On Modeling Link Flooding Attacks and Defenses

A novel architecture for detecting and defending against flooding-based DDoS attacks