A Deep ConvNet-Based Countermeasure to Mitigate Link Flooding Attacks Using Software-Defined Networks

Xing, Junchi; Cai, Jingjing; Zhou, Boyang; Wu, Chunming

doi:10.1109/iscc47284.2019.8969595

Cited by 6 publications

(10 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In tradition, detecting LFA can be classified into two types mentioned above. There are two studies that use deep learning methods to detect LFA [ 11 , 12 ]. There are normal traffic and anomalous traffic when the attack happens, so this category of deep learning method classifies two types of traffic by artificial neural networks.…”

Section: Related Workmentioning

confidence: 99%

“…In [ 11 ], the authors suggest an LFA attack detection scheme for SDN called Cyberpulse that leverages LFA traffic flow statistics to train the ANN module and then classifies them as normal and abnormal flows. The authors of [ 12 ] propose an attack detection scheme for SDN called LF-Shield that also utilizes LFA traffic statistics to train the CNN module and then classifies them as normal and abnormal flows.…”

Section: Related Workmentioning

confidence: 99%

“…The previous work focusing on mitigating LFA can be classified into two types: traffic rerouting [ 1 , 10 ] and blacklist [ 4 , 5 , 8 , 11 , 12 , 13 ]. When LFA occurs, the target links are congested continuously.…”

Section: Related Workmentioning

confidence: 99%

“…On the other hand, in [ 9 , 10 ] the authors attempt to monitor the traceroute packets, which are launched by the attacker to acquire the topology and attacks on target links. The second LFA defending step is to mitigate LFA by rerouting traffic [ 1 , 10 ] or blocking malicious traffic [ 4 , 5 , 8 , 11 , 12 , 13 ] in order to deter the attack, to relieve the harm, and to recover the attacked network to a normal status. The traffic rerouting methods reroute flows that originally travel through the target links to relieve their congestions.…”

Section: Introductionmentioning

confidence: 99%

“…To overcome the changing attack characteristics of LFA, numerous artificial intelligence (AI) methodologies [ 11 , 12 , 14 , 15 , 16 , 17 , 18 , 19 , 20 , 21 , 22 , 23 , 24 , 25 ] are introduced to defend against LFA through end-to-end functionality (Input: network status; Output: defending action) without any manual intervention [ 26 , 27 , 28 , 29 , 30 ]. The AI-based methodologies, therefore, reduce the inefficient labor cost, subjective judgment, and self-learning regarding the changing attack characteristics of LFA in a timely manner.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

A Spatiotemporal-Oriented Deep Ensemble Learning Model to Defend Link Flooding Attacks in IoT Network

Chen

Lai

Jan

et al. 2021

Sensors

View full text Add to dashboard Cite

(1) Background: Link flooding attacks (LFA) are a spatiotemporal attack pattern of distributed denial-of-service (DDoS) that arranges bots to send low-speed traffic to backbone links and paralyze servers in the target area. (2) Problem: The traditional methods to defend against LFA are heuristic and cannot reflect the changing characteristics of LFA over time; the AI-based methods only detect the presence of LFA without considering the spatiotemporal series attack pattern and defense suggestion. (3) Methods: This study designs a deep ensemble learning model (Stacking-based integrated Convolutional neural network–Long short term memory model, SCL) to defend against LFA: (a) combining continuous network status as an input to represent “continuous/combination attacking action” and to help CNN operation to extract features of spatiotemporal attack pattern; (b) applying LSTM to periodically review the current evolved LFA patterns and drop the obsolete ones to ensure decision accuracy and confidence; (c) stacking System Detector and LFA Mitigator module instead of only one module to couple with LFA detection and mediation at the same time. (4) Results: The simulation results show that the accuracy rate of SCL successfully blocking LFA is 92.95%, which is 60.81% higher than the traditional method. (5) Outcomes: This study demonstrates the potential and suggested development trait of deep ensemble learning on network security.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%