Learning-Based Proactive and Adaptive Link Flooding Attack Mitigation in AIoT

Artificial intelligence of things (AIoT) is a new networking paradigm incorporating AI and IoT, empowering multiple industries. Due to the high value of AI infrastructure in AIoT, its security issues are becoming increasingly prominent. A new type of covert DDoS attack, link flooding attack (LFA), is emerging as a vital threat. It congests critical links to AI infrastructure by manipulating multiple heterogeneous terminals to send legitimate low-speed traffic to cut off the connection of AI infrastructure while hiding itself. To quickly mitigate the LFA-induced congestion, this paper presents a learning-based proactive and adaptive LFA mitigation mechanism in AIoT. Specifically, a link suspicious level evaluation scheme based on graph autoencoder is first proposed. The potential risk links are identified by mining the link traffic features in the attack preparation and synthesizing two types of reconstruction errors, which is helpful for early to support rapid response to subsequent attacks. Second, a local traffic engineering model is presented based on maximizing the benefit of defenders. To solve the model to obtain the mitigation strategy, a solution based on deep reinforcement learning is designed to make real-time optimal local traffic path assignment decisions. Simulation results demonstrate that the proposed scheme can quickly perceive LFA and effectively resist the link congestion caused by LFA.