Blending Interest Flooding Attacks Detection in Named Data Networking

Named data networking (NDN) has been regarded as a promising scheme for next-generation network architecture, with network security remaining a key issue. In NDN, a new Distributed Denial of Service (DDoS) attack model called the interest flooding attack (IFA) has emerged and poses a serious threat to NDN. In addition, to increase the complexity of detection and defense against attacks, a variant of the IFA called the collusive interest flooding attack (CIFA) has emerged recently. Although many IFA and CIFA detection methods have been proposed, most existing countermeasures focus solely on detecting either IFA or CIFA. More importantly, to the best of our knowledge, there is no research on effective detection scheme for scenarios where IFA and CIFA coexist in a blending attack yet. In this paper, motivated by the concept that network traffic exhibits time series characteristics, we propose an attack identification and detection scheme based on WEASEL (Word ExtrAction for time SEries cLassification) aimed at accurately identifying and detecting the blending IFAs in NDN.