Resilience Evaluation of Multi-Path Routing against Network Attacks and Failures

Abstract

The current state of security and availability of the Internet is far from being commensurate with its importance. The number and strength of DDoS attacks conducted at the network layer have been steadily increasing. However, the single path (SP) routing used in today’s Internet lacks a mitigation scheme to rapidly recover from network attacks or link failure. In case of a link failure occurs, it can take several minutes until failover. In contrast, multi-path routing can take advantage of multiple alternative paths and rapidly switch to another working path. According to the level of available path control, we classfy the multi-path routing into two types, first-hop multi-path (FMP) and multi-hop multi-path (MMP) routing. Although FMP routing supported by networks, such as SD-WAN, shows marginal improvements over the current SP routing of the Internet, MMP routing supported by a global Internet architecture provides strong improvement under network attacks and link failure. MMP routing enables changing to alternate paths to mitigate the network problem in other hops, which cannot be controlled by FMP routing. To show this comparison with practical outcome, we evaluate network performance in terms of latency and loss rate to show that MMP routing can mitigate Internet hazards and provide high availability on global networks by 18 participating ASes in six countries. Our evaluation of global networks shows that, if network attacks or failures occur in other autonomous systems (ASes) that FMP routing cannot avoid, it is feasible to deal with such problems by switching to alternative paths by using MMP routing. When the global evaluation is under a transit-link DDoS attack, the loss rates of FMP that pass the transit-link are affected significantly by a transit-link DDoS attack, but the other alternative MMP paths show stable status under the DDoS attack with proper operation.

Security Control and Data Planes of SDN: A Comprehensive Review of Traditional, AI, and MTD Approaches to Security Solutions

“…HSPH [152] is a defense mechanism for port hopping. This approach enhances security effectiveness against remote attacks by introducing a dynamic port into an SDN network.…”

“…• Reduces the attack surface: MTD techniques make it challenging for attackers to discover and exploit vulnerabilities, thereby minimizing potential attack points [148], [152], [153], [156] and [157].…”

“…This approach reduces the likelihood of targeted attacks on specific network paths and reduces the overall attack surface [158]. Research has shown that port and flow randomization is a highly effective strategy for combating a range of network attacks, including LDoS, LFTO, saturation, port hopping, and topology mutation attacks [152]- [158]. This technique dynamically alters port numbers and traffic flows, compelling attackers to devote additional resources to scanning and identifying vulnerable targets.…”

ENRN: A System for Evaluating Network Resilience against Natural Disasters

“…The model's effectiveness in improving network resilience was demonstrated through a case study. In the study by An et al [42], the resilience evaluation of multi-path routing against network attacks and failures was investigated. A novel resilience metric was proposed, which can accurately measure network resilience by considering vulnerability to attacks and failures.…”

Enhance Software-Defined Network Security with IoT for Strengthen the Encryption of Information Access Control

“… Energy utilization: when choosing particle trajectories, efficiency would be considered. A charge on the switches will be made to reduce power consumption, and traffic will be scattered on roads to reduce power consumption per packet or link [ 29 ]. …”