FLoc: Dependable Link Access for Legitimate Traffic in Flooding Attacks

Lee, Soo B.; Gligor, Virgil D.

doi:10.21236/ada582042

Cited by 2 publications

(1 citation statement)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To defend against LFAs, the first step is to collect data from the network and identify suspicious traffic [10]- [17]. Most existing solutions deploy the defense system on centralized servers, which request network statistics from the data plane (i.e., forwarding devices).…”

Section: Introductionmentioning

confidence: 99%

Mew: Enabling Large-Scale and Dynamic Link-Flooding Defenses on Programmable Switches

Zhou¹,

Hong²,

Liu

et al. 2023

2023 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Link-flooding attacks (LFAs) can cut off the Internet connection to selected server targets and are hard to mitigate because adversaries use normal-looking and low-rate flows and can dynamically adjust the attack strategy. Traditional centralized defense systems cannot locally and efficiently suppress malicious traffic. Though emerging programmable switches offer an opportunity to bring defense systems closer to targeted links, their limited resource and lack of support for runtime reconfiguration limit their usage for link-flooding defenses.We present Mew1, a resource-efficient and runtime adaptable link-flooding defense system. Mew can counter various LFAs even when a massive number of flows are concentrated on a link, or when the attack strategy changes quickly. We design a distributed storage mechanism and a lossless state migration mechanism to reduce the storage bottleneck of programmable networks. We develop cooperative defense APIs to support multi-grained codetection and co-mitigation without excessive overhead. Mew's dynamic defense mechanism can constantly analyze network conditions and activate corresponding defenses without rebooting devices or interrupting other running functions. We develop a prototype of Mew by using real-world programmable switches, which are located in five cities. Our experiments show that the real-world prototype can defend against large-scale and dynamic LFAs effectively.

show abstract

Section: Introductionmentioning

confidence: 99%