Detection of Collusive Interest Flooding Attacks on Named Data Networks Based on Word Extraction for Time Series Classification

Interest flooding attacks (IFAs) has been regarded as some of the most harmful security risks in named data networks (NDNs), and they have always been highly important in the next-generation network security field. In recent years, a variant and upgraded version of the original IFA named a collusive IFA (CIFA) has been witnessed. Since a CIFA is launched intermittently and is assisted by malicious collusive coproducers, its appearance is similar to that of normal network traffic, thus making it more stealthy and more difficult to detect. The traditional attack detection approaches applied for IFA have limitations in terms of accurately and efficiently identifying CIFA. Inspired by the different appearances and characteristics of normal and attack network traffic, as well as the time series nature of network traffic, we use time series classification (TSC) techniques to capture the network traffic features of CIFA to achieve the goal of precise and efficient detection. Therefore, in this paper, a Word ExtrAction for time SEries cLassification (WEASEL)-based CIFA detection scheme is proposed. To our knowledge, no TSC-related methods have been applied to CIFA detection. The simulation results show that the proposed scheme can achieve a detection rate of 98.72%, a false alarm rate (FAR) of 0.82%, and a missed alarm rate (MAR) of 1.27% in comparisons with several typical detection schemes, thus verifying its accuracy and efficiency in CIFA detection tasks.