Traceroute-based target link flooding attack detection scheme by analyzing hop count to the destination

Sakuma, Kei; Asahina, Hiromu; Haruta, Shuichiro; Sasase, Iwao

doi:10.23919/apcc.2017.8304023

Cited by 7 publications

(10 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section, we investigate the effects of some important parameters and our observations; we compare the performance of our methods with LFAD [ 1 ] with the performance of mitigation accuracy MA t . Notably, there are eight previous works that concern defense against LFA for both detection and mitigation [ 1 , 4 , 5 , 8 , 10 , 11 , 12 , 13 ], while others [ 3 , 6 , 7 , 9 ] only deal with detection. Overall, the study of [ 1 ] performs best in terms of defending against LFA with SDN among the eight previous works cited.…”

Section: Discussionmentioning

confidence: 99%

“…Therefore, many traceroute packets will be generated before launching the attacks, so the category of traceroute packet monitoring observes the growth of the traceroute packets. In [ 9 ], the authors propose an attack detection scheme that analyzes hop count to the destination to detect LFA. Compared with legitimate users’ destination of traffic distributed evenly, the destination of traceroute, which is caused by the adversary’s reconnoitering topology near the target region before the attack, aggregates within several hops from the target link.…”

Section: Related Workmentioning

confidence: 99%

“…[2] This section reviews the theses of defending against LFA and organizes them into Table 1. The previous works focusing on detecting LFA can be classified into two types: flow metric threshold [1,[3][4][5][6][7][8] and traceroute packet monitoring [9,10]. Because LFA sends large-volume traffic, there will be some variation in traffic rate and consumed bandwidth in links.…”

Section: Lfa and Countermeasuresmentioning

confidence: 99%

“…First, the detecting step sets rules to observe flow or packet information and to judge whether LFA happen. The conventional defending LFA methodology can be classified into types of flow metric threshold [ 1 , 3 , 4 , 5 , 6 , 7 , 8 ] and traceroute packet monitoring [ 9 , 10 ]. The flow metric threshold methods determine whether LFA happen according to specific flow metrics exceeding their corresponding thresholds.…”

Section: Introductionmentioning

confidence: 99%

“…The flow metric threshold methods determine whether LFA happen according to specific flow metrics exceeding their corresponding thresholds. On the other hand, in [ 9 , 10 ] the authors attempt to monitor the traceroute packets, which are launched by the attacker to acquire the topology and attacks on target links. The second LFA defending step is to mitigate LFA by rerouting traffic [ 1 , 10 ] or blocking malicious traffic [ 4 , 5 , 8 , 11 , 12 , 13 ] in order to deter the attack, to relieve the harm, and to recover the attacked network to a normal status.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

A Spatiotemporal-Oriented Deep Ensemble Learning Model to Defend Link Flooding Attacks in IoT Network

Chen

Lai

Jan

et al. 2021

Sensors

View full text Add to dashboard Cite

(1) Background: Link flooding attacks (LFA) are a spatiotemporal attack pattern of distributed denial-of-service (DDoS) that arranges bots to send low-speed traffic to backbone links and paralyze servers in the target area. (2) Problem: The traditional methods to defend against LFA are heuristic and cannot reflect the changing characteristics of LFA over time; the AI-based methods only detect the presence of LFA without considering the spatiotemporal series attack pattern and defense suggestion. (3) Methods: This study designs a deep ensemble learning model (Stacking-based integrated Convolutional neural network–Long short term memory model, SCL) to defend against LFA: (a) combining continuous network status as an input to represent “continuous/combination attacking action” and to help CNN operation to extract features of spatiotemporal attack pattern; (b) applying LSTM to periodically review the current evolved LFA patterns and drop the obsolete ones to ensure decision accuracy and confidence; (c) stacking System Detector and LFA Mitigator module instead of only one module to couple with LFA detection and mediation at the same time. (4) Results: The simulation results show that the accuracy rate of SCL successfully blocking LFA is 92.95%, which is 60.81% higher than the traditional method. (5) Outcomes: This study demonstrates the potential and suggested development trait of deep ensemble learning on network security.

show abstract