Abstract
Link-flooding attack (LFA) is a new type of DDoS attack used to flood and congest the crucial network links, which has severely damaged enterprise networks. LFA can be launched by large-scale low-rate legitimate data flows with quite a low cost and is difficult to detect. While target areas in a network can be easily isolated since the crucial links are unavailable. SDN architecture provides new opportunities to address this critical network security problem with its global view of traffic monitoring enabled by the separation of data plane and control plane. Recently, segment routing (SR), which is an evolution of source routing, has been viewed as a promising technique for flow rerouting and failure recovery. Segment routing is a lightweight easy-deployed scheme known for its flexibility, scalability, and applicability. Therefore, in this paper, we try to mitigate LFA with segment rerouting within the SDN architecture. With the comprehensive network-wide view of the data flows and links, we first design a monitoring mechanism to detect LFA based on the availability of the crucial links. Then we use segment routing to detour the congested flows and alleviate the burden on the crucial links. Finally. the LFA bots will be identified and the malicious traffic will be blocked. Sufficient evaluations demonstrate that our LFA defense can efficiently detect LFA and preserve the network services, while only introduce a little signaling overhead between the controllers and data plane.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Studer, A., Perrig, A.: The coremelt attack. In: Backes, M., Ning, P. (eds.) ESORICS 2009. LNCS, vol. 5789, pp. 37–52. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-04444-1_3
Kang, M.S., Lee, S.B., Gligor, V.G.: The crossfire attack. In: 2013 Proceedings of IEEE Symposium on Security and Privacy, pp. 127–141 (2013). https://doi.org/10.1109/SP.2013.19
Feamster, N., Rexford, J., Zegura, E.: The road to SDN. ACM SIGCOMM Comput. Commun. Rev. 44(2), 87–98 (2014). https://doi.org/10.1145/2602204.2602219
Xia, W., Wen, Y., Foh, C.H., Niyato, D., Xie, H.: A survey on software-defined networking. IEEE Commun. Surv. Tutor. 17(1), 27–51 (2015). https://doi.org/10.1109/COMST.2014.2330903
Mckeown, N., Anderson, T., Balakrishnan, H., Parulkar, G.M., Turner, J.S.: OpenFlow: enabling innovation in campus networks. ACM SIGCOMM Comput. Commun. Rev. 38(2), 69–74 (2008). https://doi.org/10.1145/2602204.2602219
OpenFlow: Openflow. http://archive.openflow.org/
Filsfils, C., Nainar, N.K., Pignataro, C., Cardona, J.C., Francois, P.: The segment routing architecture. In: Proceedings of 2015 IEEE Global Communications Conference, GLOBECOM, pp. 1–6 (2015). https://doi.org/10.1109/GLOCOM.2014.7417124
Abdullah, Z.N., Ahmad, I., Hussain, I.: Segment routing in software defined networks: a survey. IEEE Commun. Surv. Tutor. 21(1), 464–486 (2019). https://doi.org/10.1109/COMST.2018.2869754
Desmouceaux, Y., Pfister, P., Tollet, J., Townsley, M., Clausen, T.: 6LB: scalable and application-aware load balancing with segment routing. IEEE/ACM Trans. Netw. 26(2), 819–834 (2018). https://doi.org/10.1109/TNET.2018.2799242
Hao, F., Kodialam, M., Lakshman, T.V.: Optimizing restoration with segment routing. In: Proceedings of IEEE INFOCOM, pp. 1–9, July 2016. https://doi.org/10.1109/INFOCOM.2016.7524551
Shin, S., Porras, P.A., Yegneswaran, V., Fong, M.W., Gu, G., Fresco, M.T.: Modular composable security services for software-defined networks. In: Proceedings of Distributed System Security Symposium (NDSS) (2013)
Shin, S., Yegneswaran, V., Porras, P., Gu, G.: AVANT-GUARD: scalable and vigilant switch flow management in software-defined networks. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security, pp. 413–424. ACM (2013)
Hu, H., Han, W., Ahn, G.J., Zhao, Z.: FLOWGUARD: building robust firewalls for software-defined networks. In: Proceedings of the Workshop on Hot Topics in Software Defined Networking, pp. 97–102 (2014)
Fayaz, S.K., Tobioka, Y., Sekar, V., Bailey, M.: Bohatei: flexible and elastic DDoS defense. In: Proceedings of 24th USENIX Security Symposium (USENIX Security 15), pp. 817–832 (2015)
Xue, L., Luo, X., Chan, E.W., Zhan, X.: Towards detecting target link flooding attack. In: Proceedings of the 28th Large Installation System Administration Conference (LISA14), pp. 90–105 (2014)
Lee, S.B., Kang, M.S., Gligor, V.D.: CoDef: collaborative defense against large-scale link-flooding attacks. In: Proceedings of the 9th ACM Conference on Emerging Networking Experiments and Technologies, pp. 417–428. ACM (2013)
Kang, M.S., Gligor, V.D., Sekar, V.: SPIFFY: inducing cost-detectability tradeoffs for persistent link-flooding attacks. In: Proceedings of Network and Distributed System Security Symposium (NDSS) (2016)
Gillani, F., Al-Shaer, E., Lo, S., Duan, Q., Ammar, M., Zegura, E.: Agile virtualized infrastructure to proactively defend against cyber attacks. In: Proceedings of 2015 IEEE Conference on Computer Communications (INFOCOM), pp. 729–737. IEEE (2015)
Aydeger, A., Saputro, N., Akkaya, K., Rahman, M.: Mitigating crossfire attacks using SDN-based moving target defense. In: Proceedings of IEEE Conference on Local Computer Networks (LCN), pp. 627–630 (2016)
Wang, L., Li, Q., Jiang, Y., Wu, J.: Towards mitigating link flooding attack via incremental SDN deployment. In: Proceedings of IEEE Symposium on Computers and Communication (ISCC), pp. 397–402 (2016)
Liaskos, C.K., Kotronis, V., Dimitropoulos, X.: A novel framework for modeling and mitigating distributed link flooding attacks. In: Proceedings of 2015 IEEE Conference on Computer Communications (INFOCOM) (2016)
Wang, J., Wen, R., Li, J., Yan, F., Zhao, B., Yu, F.: Detecting and mitigating target link-flooding attacks using SDN. IEEE Trans. Dependable Secur. Comput. 5971(c), 1–13 (2018). https://doi.org/10.1109/TDSC.2018.2822275
Acknowledgement
This work is funded by the Civil Aviation Joint Research Fund Project of National Natural Science Foundation of China under granted number U1833107.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Switzerland AG
About this paper
Cite this paper
Xie, L., Ding, Y., Yang, H. (2019). Mitigating Link-Flooding Attack with Segment Rerouting in SDN. In: Vaidya, J., Zhang, X., Li, J. (eds) Cyberspace Safety and Security. CSS 2019. Lecture Notes in Computer Science(), vol 11982. Springer, Cham. https://doi.org/10.1007/978-3-030-37337-5_6
Download citation
DOI: https://doi.org/10.1007/978-3-030-37337-5_6
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-37336-8
Online ISBN: 978-3-030-37337-5
eBook Packages: Computer ScienceComputer Science (R0)