SatLFAGuard: A Detection and Mitigation Framework for Link Flooding Attack in SDN-Based Satellite Network

Link flooding attacks (LFA) represent a destructive yet stealthy type of Distributed Denial of Service (DDoS) attack that overwhelms target inter-satellite links (ISLs) within low Earth orbit (LEO) satellite networks. However, existing LFA detection and mitigation solutions, while effective in terrestrial networks, are not well-suited to address LFAs in satellite networks due to their unique characteristics. To address this challenge, we propose SatLFAGuard, a novel framework for LFA detection and mitigation. The core innovation lies in reformulating the LFA detection problem as a classification task to identify adjacent abnormal nodes. This classification problem can be effectively tackled using spatial and temporal graph convolutional neural network, which leverages features that capture both satellite node-level information and the spatial topology of LEO networks. For LFA mitigation, we introduce a multipath coordinated transmission strategy that schedules multiple paths within LEO and transmit the congested traffic in parallel, compelling attackers to abandon the attack by substantially increasing their resource cost. Specifically, SatLFAGuard comprises three key components: (1) a satellite node state awareness mechanism based on In-band Network Telemetry (INT), which periodically collects real-time, fine-grained node load levels; (2) a graph-based anomaly detection module leveraging an attention-enhanced spatiotemporal graph convolutional network (ASTGCN) to identify abnormal nodes and (3) a multipath coordinated transmission strategy that dispatches traffic across multiple paths upon attack detection, increasing the cost for adversaries while preserving legitimate communication. The experimental results on the Iridium constellation demonstrate that SatLFAGuard can accurately detect LFA attacks while maintaining a low false positive rate, significantly outperforming than baseline methods. Upon the detection of LFA, SatLFAGuard is able to assimilate the attack traffic in a responsive manner with acceptable resource overhead.