Evaluating and mitigating a Collusive version of the Interest Flooding Attack in NDN

Abstract

Named-Data Networking (NDN) is a promising architecture for the future Internet. However, it is hampered by interest flooding, an NDN-tailored DDoS attack which has been shown to cause dropping majority of legitimate packets. While several defence mechanisms have been suggested against it, they cannot protect NDN against the Collusive Interest Flooding Attack (CIFA), a previously disregarded version of interest flooding. In CIFA, malicious clients issue interest packets that can be satisfied only by a malicious server. The server, in turn, responds with data packets just before expiration of the corresponding PIT entries. We study the effect of CIFA. Extensively simulating CIFA, we show that it affects the network and legitimate users almost as badly as an extensively researched version of interest flooding. Subsequently, we develop a generic defence mechanism against interest flooding attacks. The mechanism is based on CoMon, our framework for coordination in NDN. Thanks to CoMon, the attacks are detected and mitigated at an early stage by only a few routers. Via realistic simulations, we show that our defence decreases the amount of dropped legitimate packets remarkably, incurring a very low signalling overhead.