Abstract:In recent years, there are substantial demands to reduce packet loss in the Internet. Among the schemes proposed, finding backup paths in advance is considered to be an effective method to reduce the reaction time. Very commonly, a backup path is chosen to be a most disjoint path from the primary path, or in the network level, backup paths are computed for all links (e.g., IPRFF). The validity of this straightforward choice is based on 1) all the links may fail with equal probability; and 2) facing the high protection requirement today, having links not protected or sharing links between the primary and backup paths just simply look weird. Nevertheless, indications from many research studies have confirmed that the vulnerability of the links in the Internet is far from equality. In addition, we have seen that full protection schemes may introduce high costs. In this paper, we argue that such approaches may not be cost effective. We first analyze the failure characteristics based on real world traces from CERNET2, the China Education and Research NETwork 2. We observe that the failure probabilities of the links is heavy-tail, i.e., a small set of links caused most of the failures. We thus propose a selective protection scheme. We carefully analyze the implementation details and the overhead for general backup path schemes of the Internet today. We formulate an optimization problem where the routing performance (in terms of network level availability) should be guaranteed and the backup cost should be minimized. This cost is special as it involves computation overhead. Consequently, we propose a novel Critical-Protection Algorithm which is fast itself. We evaluate our scheme systematically, using real world topologies and randomly generated topologies . We show significant gain even when the network availability requirement is 99.99% as compared to that of the full protection scheme. © 2009 IEEE.

A Persistent Route Diversification Mechanism for Defending Against Stealthy Crossfire Attack

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Combination Attacks and Defenses on SDN Topology Discovery.

Effective DDoS Mitigation Via ML-Driven In-network Traffic Shaping

Trading Routing Diversity for Better Network Performance.

A novel mechanism to defend against low-rate denial-of-service attacks

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

DeepThrottle: Deep Reinforcement Learning for Router Throttling to Defend Against DDoS Attack in SDN

An Adaptive Defending Mechanism Against Distributed Denial-of-Service (DDoS) Attacks

Multipath Resilient Routing for Endogenous Secure Software Defined Networks.

Realtime DDoS Defense Using COTS SDN Switches via Adaptive Correlation Analysis

An efficient critical protection scheme for intra-domain routing using link characteristics

A Defense Strategy Against LDDoS Attack Aggregation in DCN.

Toward Optimal Adaptive Online Shortest Path Routing with Acceleration under Jamming Attack.

Selective protection: A cost-efficient backup scheme for link state routing

DDoS Defense Mechanism Based on Software Defined Network

A Collaborative Routing Protocol Against Routing Disruptions in MANETs

Deep Reinforcement Learning based Smart Mitigation of DDoS Flooding in Software-Defined Networks

A Router Abnormal Traffic Detection Strategy Based on Active Defense

Resisting Network Ddos Attacks By Packet Asymmetry Path Marking