The Crossfire Attack

Abstract

We present the Crossfire attack -a powerful attack that degrades and often cuts off network connections to a variety of selected server targets (e.g., servers of an enterprise, a city, a state, or a small country) by flooding only a few network links. In Crossfire, a small set of bots directs lowintensity flows to a large number of publicly accessible servers. The concentration of these flows on the small set of carefully chosen links floods these links and effectively disconnects selected target servers from the Internet. The sources of the Crossfire attack are undetectable by any targeted servers, since they no longer receive any messages, and by network routers, since they receive only low-intensity, individual flows that are indistinguishable from legitimate flows. The attack persistence can be extended virtually indefinitely by changing the set of bots, publicly accessible servers, and target links while maintaining the same disconnection targets. We demonstrate the attack feasibility using Internet experiments, show its effects on a variety of chosen targets (e.g., servers of universities, US states, East and West Coasts of the US), and explore several countermeasures.

Traceroute-based target link flooding attack detection scheme by analyzing hop count to the destination

“…It is easily guessed that the sufficient detection accuracy cannot be maintained if the sending interval is further lengthened. However, the attacker cannot unduly lengthen the sending interval because more than 30% of network topology is dynamically changed [1].…”

“…We assume that each AS has only one router to simplify simulations. In accordance with [1], the number of bots and decoy servers is set to twice as many as the number of ASes. A bot sends traceroutes to all decoy servers three times at any given point in time.…”

“…Recently, target link flooding attack (TLFA) which is a new type of DDoS attack has been proposed [1]. This attack cuts off specific links, referred to as target links (TL), over the Internet and disconnects a specific region, referred to as a target area, from other regions.…”

A Spatiotemporal-Oriented Deep Ensemble Learning Model to Defend Link Flooding Attacks in IoT Network

“…All servers in the target area will then be degraded or even cut off from network connectivity [1]. Furthermore, for the purpose of expanding the effectiveness of attacks and ensuring the indistinguishability of attack traffic from legitimate traffic, LFA dynamically attacks different target links during different periods, which is called a spatiotemporal series attack pattern [2]. For example, LFA attack some set of target links for a while and attack the other set of target links at another time-space.…”

A HMM-R Approach to Detect L-DDoS Attack Adaptively on SDN Controller

“…As a new distributed denial of service (DDoS) attacks, low-rate distributed denial of service (L-DDoS) attacks mainly take advantage of some security vulnerabilities of the network protocol or adaptive mechanism to reduce network performance [2]. An intelligent attack-CrossFire is proposed in [3], this attack initiates link attacks at a low rate, and then generates aggregated traffic flow through multiple attack sources to achieve the purpose of blocking services in the data center. It can be known that L-DDoS not only could reduce the service performance of the data center, but also could cause a collapse in the network link.…”