Mitigate DDoS attacks in NDN by interest traceback
Mitigate DDoS attacks in NDN by interest traceback
复制标题
DOI：
10.1109/infcomw.2013.6970722
复制
发表时间：
2013-04
期刊：
影响因子：
--
通讯作者：
Huichen Dai;Yi Wang;Jindou Fan;B. Liu
中科院分区：
文献类型：
--
作者：
Huichen Dai;Yi Wang;Jindou Fan;B. Liu
当前的互联网由于其功能从主机到主机的通信向内容分发的转变，已经达到了其能力的极限。命名数据网络（NDN）-以内容为中心的网络方法的实例，通过强调内容本身而不是内容所在的位置来实现这一转变。NDN试图提供比当前互联网更好的安全性和隐私性，并且对分布式拒绝服务（DDoS）的弹性是一个重要问题。在本文中，我们提出了一个特定的和具体的情况下，在NDN的DDoS攻击，肇事者利用NDN的数据包转发规则发送兴趣数据包与欺骗的名称作为攻击数据包。然后，我们确定了NDN DDoS攻击的受害者，包括主机和路由器。但最大的受害者不是主机，而是路由器，更具体地说，是路由器内的未决兴趣表（PIT）。PIT为NDN带来了许多优雅的特性，但它存在漏洞。我们提出兴趣回溯作为一种对抗措施，对研究的NDN DDoS攻击，它可以追溯到发起攻击的兴趣包。最后，我们评估了这些NDN DDoS攻击所带来的危害，并评估了兴趣追踪对策。评估结果表明，兴趣回溯方法有效地减轻了NDN DDoS攻击的研究。
Current Internet is reaching the limits of its capabilities due to its function transition from host-to-host communication to content dissemination. Named Data Networking (NDN) - an instantiation of Content-Centric Networking approach, embraces this shift by stressing the content itself, rather than where it locates. NDN tries to provide better security and privacy than current Internet does, and resilience to Distributed Denial of Service (DDoS) is a significant issue. In this paper, we present a specific and concrete scenario of DDoS attack in NDN, where perpetrators make use of NDN's packet forwarding rules to send out Interest packets with spoofed names as attacking packets. Afterwards, we identify the victims of NDN DDoS attacks include both the hosts and routers. But the largest victim is not the hosts, but the routers, more specifically, the Pending Interest Table (PIT) within the router. PIT brings NDN many elegant features, but it suffers from vulnerability. We propose Interest traceback as a counter measure against the studied NDN DDoS attacks, which traces back to the originator of the attacking Interest packets. At last, we assess the harmful consequences brought by these NDN DDoS attacks and evaluate the Interest traceback counter measure. Evaluation results reveal that the Interest traceback method effectively mitigates the NDN DDoS attacks studied in this paper.