STGCN-Based Link Flooding Attack Detection and Mitigation in Software-Defined Network

Link Flooding Attacks (LFA) are increasingly challenging the availability and stability of Software-Defined Networks (SDN), leveraging their distributed and covert nature to escape detection. Existing methods such as packet analysis and behavioral patterns struggle with pinpointing specific target attack paths due to the dynamic routing and distribution of attack traffic across multiple entry points, making it difficult to implement defensive measures effectively. This paper introduces a novel detection method using a Spatial-Temporal Graph Convolutional Network (STGCN), which combines the strengths of Convolutional Neural Networks (CNN) for temporal pattern recognition and Graph Neural Networks (GNN) for spatial topology analysis. Unlike traditional approaches, our model leverages In-Band Network Telemetry (INT) for real-time traffic and topology monitoring, enhancing our ability to pinpoint and mitigate LFAs. We innovatively transform the detection of attacked links into a dual-point anomaly detection problem, significantly increasing the accuracy of identifying compromised links. Experimental results demonstrate that our method not only achieves high detection accuracy but also ensures the efficient use of network resources, making it particularly effective for resource-constrained environments.