On the Interplay of Link-Flooding Attacks and Traffic Engineering

Abstract

Link-flooding attacks have the potential to disconnect even entire countries from the Internet. Moreover, newly proposed indirect link-flooding attacks, such as 'Crossfire', are extremely hard to expose and, subsequently, mitigate effectively. Traffic Engineering (TE) is the network's natural way of mitigating link overload events, balancing the load and restoring connectivity. This work poses the question: Do we need a new kind of TE to expose an attack as well? The key idea is that a carefully crafted, attack-aware TE could force the attacker to follow improbable traffic patterns, revealing his target and his identity over time. We show that both existing and novel TE modules can efficiently expose the attack, and study the benefits of each approach. We implement defense prototypes using simulation mechanisms and evaluate them extensively on multiple real topologies.

arXiv comment6 pages, 3 figures, ACM CCR

References in corpus (1)

• A Novel Framework for Modeling and Mitigating Distributed Link Flooding Attacks

Cited by in corpus (8)

• Adaptive Artificial Immune Networks for Mitigating DoS flooding Attacks
• Active Link Obfuscation to Thwart Link-flooding Attacks for Internet of Things
• Detecting Target-Area Link-Flooding DDoS Attacks using Traffic Analysis and Supervised Learning
• PINT: Probabilistic In-band Network Telemetry
• Application-Network Collaboration Using SDN for Ultra-Low Delay Teleorchestras
• The Socket Store: An App Model for the Application-Network Interaction
• Early detection of Crossfire attacks using deep learning
• Stackelberg Equilibria for Two-Player Network Routing Games on Parallel Networks