Cooperative detection and protection for Interest flooding attacks in named data networking

Ding, Kun; Liu, Yun; Cho, Hsin Hung; Chao, Han Chieh; Shih, Timothy K.

doi:10.1002/dac.2883

Cited by 21 publications

(13 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As opposed to previous works, the routers work independently, and false alarm probability can be controlled by selecting a well-defined threshold. Furthermore, the detection threshold given a particular false-alarm probability considering packet loss probability is derived in Nguyen et al 19 In Ding et al, 24 the authors proposed to use vector space model and Markov model to detect a DDoS attack in NDN. A retransmission method is proposed for ensuring the legitimate user request.…”

Section: Dos/ddos Mitigation In Icnmentioning

confidence: 99%

Dual‐collaborative DoS/DDoS mitigation approach in information‐centric mobile Internet

Chen

Jia

Liu

2019

Int J Communication

View full text Add to dashboard Cite

The amount of wireless traffic is increasing at an overwhelming speed.Information-centric networking (ICN) has been proposed as a promising Future Internet Architecture, which can reduce network traffic by putting data objects toward the edge. It is expected that in information-centric mobile Internet (ICMI), the wireless traffic can be significantly reduced. Yet, DoS/DDoS attack becomes a critical issue in ICMI by causing wireless gateway blockade. To tackle the problem, we propose a dual-collaborative DoS/DDoS mitigation approach (DCMA) and advanced DCMA to protect wireless gateways. In the algorithm, the attackers' visiting information including international mobile equipment identity (IMEI) and data object name (DON) are analyzed jointly to accurately identify potential attackers through the collaboration between the Internet and mobile network. In addition, the attacker's behaviors are analyzed centrally, and security strategies are applied distributively throughout wireless edge through the collaboration between wireless core network (CN) and radio access network (RAN). Extensive simulations are performed to verify the effectiveness of the proposed algorithms. The results demonstrate that advanced DCMA can achieve high DDoS and attacker detection probability and small false positive probability. KEYWORDS collaborative, DoS/DDoS mitigation, information centric, mobile InternetInt J Commun Syst. 2020;33:e4241.wileyonlinelibrary.com/journal/dac wireless radio access network (RAN) and core network (CN) to further improve user experience. With the assistance of wireless heterogeneous networks, wireless users can access to the Internet service ubiquitously. On the other hand, the design of the Internet has been shifted from a host-centric architecture toward an information-centric architecture for the support of scalable content retrieval, security, mobility, etc. 3 In informationcentric networking (ICN), information objects are named and used for data requesting and transmission as opposed to the IP address used in the current Internet, and the focus for service providing has changed from host-to-host mode to information-centric mode. Currently, the ICN design is actively investigated in several research projects. Some of the representative ICN architectures are data-oriented network architecture (DONA) 4 developed from UC Berkeley, named data networking (NDN) 5 based on content-centric networking (CCN) architecture supported by the US Future Internet Architecture program, publish-subscribe Internet technology (PURSUIT) 6 funded by EU Framework 7 Program, and smart identifier network (SINET) 7 supported by the China National Basic Research Program. While the above ICN architectures mainly differ in naming, information request, and content data transmitting methodologies, caching functionality is adopted for all the ICN architecture.Since ICN can greatly aid networks for achieving the end-to-end QoS through pushing content toward the network edge, the application of ICN in wireless networks has been investigated....

show abstract

Section: Dos/ddos Mitigation In Icnmentioning

confidence: 99%

Dual‐collaborative DoS/DDoS mitigation approach in information‐centric mobile Internet

Chen

Jia

Liu

2019

Int J Communication

View full text Add to dashboard Cite

show abstract

“…More recently, research [12] argues that IFA can be easily launched even when the attackers have very limited resource, and suggest to notify the user identifier of each attacker by the edge routers which detect IFA, meanwhile to employ router authentication mechanism so that malicious notification messages from compromised routers can be prevent, which is efficient and effective even in future fifth generation (5G) cellular networks where edge routers may join and leave the network frequently. In addition, the work in [13] employs an interest marking mechanism into every edge NDN router, and every interest packet travelling through an edge NDN router is firstly marked with the identification code (ID) of this router before being forwarded, which helps the identification of the malicious area, and achieves cooperative detection with the help of modelling three properties of IFA: PIT occupancy ratio, PIT expire ratio and potential attacker ratio (e.g. a value deduced from the edge router ID where most malicious interest packets originate currently).…”

Section: Related Workmentioning

confidence: 99%

“…a value deduced from the edge router ID where most malicious interest packets originate currently). Moreover, the authors in [13] also introduced a retransmission forwarding mechanism to ensure legitimate interest packets, based on the fact that malicious interest packets are with varying names to enhance resource consumption of PIT, while the legitimate interest packets are retransmitted with the same name if the requested content is not returned.Similarly, the work in [14] argues that the fake interest packets should be responded by certain fake data packets to reduce the burden of involved routers along the attacking path, and thus they design the mechanism named ‘interest traceback’ to achieve above goals. In fact, the effect of interest traceback is the same with Interest NACK.…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

On the urgency of implementing Interest NACK into CCN: from the perspective of countering advanced interest flooding attacks

et al. 2018

View full text Add to dashboard Cite

Content centric networking (CCN) where content/named data as the first entity has become one of the most promising architectures for the future Internet. To achieve better security, the Interest NACK mechanism is introduced into CCN; however, it has not attracted enough attention and most of the CCN architectures do not embed Interest NACK until now. This study focuses on analysing the urgency of implementing Interest NACK into CCN, by designing a novel network threat named advanced interest flooding attack (AIFA) to attack CCN, which can not only exhaust the pending interest table (PIT) resource of each involved router just as normal interest flooding attack (IFA), but also keep each PIT entry unexpired until it finishes, making it harder to detect and more harmful when compared with the normal IFA. Specifically, the damage of AIFA on CCN architecture with and without Interest NACK is evaluated and analysed, compared with normal IFA, and then the urgency of implementing Interest NACK is highlighted.

show abstract

“…The first two solutions (Interests with long timeout and never dying PIT entries) are theoretically possible, but they are not completely scalable because they require to store a massive amount of state on intermediate routers for a possibly long time. The situation can even get worse in case of malicious attacks, as many recent papers demonstrated . For this reason, we do not consider them in our evaluation section, as we are interested in Internet scale applications (like a social network application is).…”

Section: Related Workmentioning

confidence: 99%

Push applications and dynamic content generation over content‐centric networking

Virgilio

Marchetto

Sisto

2015

Int J Communication

View full text Add to dashboard Cite

SUMMARYContent-Centric Networking (CCN) represents an established candidate for the future Internet, proposing a routing architecture designed to elevate content to first class entity. Starting from the fact that the network usage has dramatically evolved towards content retrieval, CCN relies on an on-demand pull based mechanism to transfer data from the different sources to the heterogeneous consumers. This paradigm enhances the network in a number of ways, ranging from the newly introduced in-network caching capabilities to the benefits provided by the symmetric data routing adopted by CCN. In this renewed network scenario, we place our attention to those applications that do not perfectly fit the pull paradigm, stating that they need to be supported as well and proposing an effective way to achieve scalability on large scale push applications. We provide the following contributions: (i) we identify the functions that a data-centric architecture should support; (ii) propose and compare our solution with the state of the art framework designed for the specific problem of pushing data to content requesters; and (iii) evaluate their performance in terms of traffic generated and scalability achieved by simulating a real Internet Service Provider (ISP) topology and the realistic workload of a generic social network application.

show abstract

Cooperative detection and protection for Interest flooding attacks in named data networking

Cited by 21 publications

References 25 publications

Dual‐collaborative DoS/DDoS mitigation approach in information‐centric mobile Internet

Dual‐collaborative DoS/DDoS mitigation approach in information‐centric mobile Internet

On the urgency of implementing Interest NACK into CCN: from the perspective of countering advanced interest flooding attacks

Push applications and dynamic content generation over content‐centric networking

Contact Info

Product

Resources

About