Interest Flooding Mitigation in Content-Centric Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Content-centric networks (CCNs) are vulnerable to Distributed Denial of Service (DDoS) attacks, particularly interest flooding attacks, which overwhelm network resources and disrupt service by injecting excessive interest packets, leading to network congestion and memory exhaustion at intermediate routers.
Innovation Solution
The system mitigates interest flooding attacks by calculating interest satisfaction ratios (ISRs) for each interface and name prefix, throttling incoming interest packets based on these ratios, and distributing forwarding tokens among interfaces to prioritize legitimate traffic while penalizing malicious requests, ensuring symmetric flow of interest and data packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network forwards all interest packets without filtering, then network service availability is maintained for legitimate traffic, but network resources become overwhelmed by malicious flooding attacks
Solution Approach 1:
The patent implements a feedback mechanism where routers monitor the satisfaction rate of interest packets (ratio of satisfied interests to total received interests) and use this feedback to dynamically adjust forwarding decisions. When the satisfaction rate drops below a threshold, the router infers an attack is occurring and begins dropping interests from affected interfaces, thus resolving the contradiction between maintaining service availability and preventing resource exhaustion.
Solution Approach 2:
The system enables routers to autonomously detect and respond to flooding attacks using locally observed statistics without requiring external intervention or complex centralized control. Each router independently calculates satisfaction rates, identifies attacked interfaces, and adjusts its own forwarding behavior, allowing the network to self-protect against DDoS attacks while maintaining legitimate traffic flow.
2Object-affected harmful factors
If the network implements strict filtering of interest packets, then malicious traffic is blocked, but legitimate traffic may be incorrectly dropped
Solution Approach 1:
The patent employs dynamic threshold adjustment based on observed satisfaction rates rather than static filtering rules. The forwarding decision threshold adapts in real-time according to network conditions and attack patterns, allowing the system to be more permissive when satisfaction is high (reducing false positives) and more restrictive when satisfaction drops (blocking attacks effectively), thus resolving the contradiction between blocking malicious traffic and preserving legitimate traffic.
Solution Approach 2:
The system changes the parameter of interest forwarding probability based on the calculated satisfaction rate. When satisfaction rate is above the threshold, interests are forwarded with high probability; when below the threshold, forwarding probability is reduced. This parameter adaptation allows the system to dynamically balance between blocking attacks and maintaining legitimate service.
3Measurement precision
If the network maintains detailed per-interface statistics for all interest packets, then accurate attack detection is achieved, but memory consumption increases significantly
Solution Approach 1:
The patent segments the statistics maintenance into essential per-interface satisfaction rate tracking rather than maintaining detailed per-packet or per-content-state information for all interfaces. By focusing only on the aggregate satisfaction rate (number of satisfied interests divided by number of received interests) per interface, the system achieves sufficient detection accuracy with minimal memory consumption, resolving the contradiction between detection precision and resource usage.
Data Source
AI summary
One embodiment of the present invention provides a system for mitigating interest flooding attacks in content-centric networks (CCNs). During operation, the system receives, at a physical interface of a router, an interest packet; obtains current interest satisfaction statistics associated with the physical interface; and determines whether to forward or drop the interest packet based on the current interest satisfaction statistics.