Source-linked AI summary
Poseidon: Mitigating Interest Flooding DDoS Attacks in Named Data Networking
Alberto Compagno, Mauro Conti, Paolo Gasti, Gene Tsudik
TL;DR
NDN’s PIT state creates a vulnerability to interest flooding DDoS attacks, which the paper evaluates experimentally. The authors simulate attacks and introduce Poseidon, a local and collaborative detection-and-mitigation framework; under attack, most routers using the countermeasure use more than 80% of available bandwidth.
Problem
Interest flooding exploits NDN router PIT state, and the paper investigates whether limited-resource adversaries can significantly disrupt network performance.
Method
The paper uses CCNx over NS-3 and the AT&T topology to evaluate attacks and develops Poseidon using local metrics and collaborative push-back techniques.
Results
More than 80% of available bandwidth is used by most routers running Poseidon during the attack, compared with content traffic reductions of about 80% without countermeasures.
Takeaways & Limitations
Interest flooding is a realistic NDN threat, while Poseidon provides significant local and collaborative mitigation benefits within the evaluated setup.
Abstract
from arXiv · showhide
Content-Centric Networking (CCN) is an emerging networking paradigm being considered as a possible replacement for the current IP-based host-centric Internet infrastructure. In CCN, named content becomes a first-class entity. CCN focuses on content distribution, which dominates current Internet traffic and is arguably not well served by IP. Named-Data Networking (NDN) is an example of CCN. NDN is also an active research project under the NSF Future Internet Architectures (FIA) program. FIA emphasizes security and privacy from the outset and by design. To be a viable Internet architecture, NDN must be resilient against current and emerging threats. This paper focuses on distributed denial-of-service (DDoS) attacks; in particular we address interest flooding, an attack that exploits key architectural features of NDN. We show that an adversary with limited resources can implement such attack, having a significant impact on network performance. We then introduce Poseidon: a framework for detecting and mitigating interest flooding attacks. Finally, we report on results of extensive simulations assessing proposed countermeasure.
I. INTRODUCTION
NDN is a content-centric architecture designed for efficient content distribution, but its architectural features create security concerns, including interest flooding DDoS attacks. This paper investigates that threat and presents Poseidon as a detection and mitigation framework.
- NDN motivation: NDN makes named content, rather than hosts, central to communication and is intended to support efficient large-scale content distribution.Consumers request content by name, allowing the network to locate nearby copies and support multicast, replication, and fault tolerance.
- Security motivation: NDN emphasizes security by design, motivating investigation of DDoS threats before the architecture is considered for large-scale deployment.The paper focuses specifically on interest flooding, which exploits NDN architectural features.
- Security motivation: Interest flooding is a plausible attack vector because each consumer interest causes routers to retain transient state until content returns or the state is flushed.Prior work identified this retained state as a potential basis for attack.
- Paper scope: The study uses extensive simulations to show that interest flooding is feasible with limited resources and can significantly affect network performance.The evaluation uses the AT&T network topology and examines reactive countermeasures for early detection.
- Paper scope: The paper designs and evaluates Poseidon, a framework for local and distributed mitigation of interest flooding attacks.The framework is intended to detect attacks early and mitigate their effects.
II. NDN OVERVIEW
NDN delivers named content through interest messages and manages forwarding with router state in Pending Interest Tables. Returned content follows the reverse interest path, while unsatisfied state eventually expires.
- Messages: NDN supports interest messages for requesting named content and content messages carrying a name, payload, and producer signature.Content is delivered only after an explicit consumer request, whereas interests are unsigned.
- Forwarding state: Routers forward interests by name prefixes and maintain Pending Interest Table entries containing outstanding interests and their arrival interfaces.The PIT determines how a newly received interest relates to existing requests for the same name.
- Content return: When a producer satisfies an interest, content travels back along the reverse path and routers delete the corresponding PIT entries.Routers may also cache forwarded content in their local Content Stores.
- Unsuccessful requests: Interests that cannot be satisfied generate no error packet, and their PIT entries are removed after a predefined expiration time.Consumers may regenerate the same interest after a timeout.
III. INTEREST FLOODING
Interest flooding attacks exploit NDN routers’ Pending Interest Tables by generating many interests faster than entries are removed. The attack can use existing, dynamic, or nonexistent content requests to keep PIT state occupied.
- Attack mechanism: Interest flooding rapidly generates interests that saturate a victim router’s PIT, causing subsequent un-collapsible interests to be dropped.Saturation occurs when incoming interest rates exceed the rate at which PIT entries are removed by returned content or expiration.
- Attack comparison: The attack primarily targets routers, unlike SYN flooding, which primarily consumes connection state on victim hosts.End hosts are secondary victims of interest flooding.
- Attack strategies: Adversaries can flood with interests for existing static content, dynamically generated content, or nonexistent content called fake interests.These strategies differ in cache behavior, producer load, and whether requested content can ever return.
- Attack strategies: Requests for existing content can be made distinct to avoid interest collapsing, while congestion or slow satisfaction keeps entries in the victim’s PIT until expiration.Router caches may reduce the impact when they can satisfy requested content.
- Attack strategies: Dynamic-content flooding can increase producer load, round-trip latency, and dropped-packet rates, causing adversarial interests to remain in the PIT longer.Unlike static cached content, dynamically generated content cannot be precomputed and served from caches in the same way.
- Attack strategies: Nonexistent-content flooding creates PIT entries that cannot be satisfied, remain until expiration, and do not depend on content bandwidth or adversary receipt capacity.Router caches cannot satisfy these interests because the requested content does not exist.
- Attack construction: Interests for a random component under an advertised namespace are routed through the router advertising that namespace.For example, interests under /nsf/fia/ can be directed through the corresponding router.
IV. EVALUATION ENVIRONMENT
The evaluation runs the official CCNx NDN implementation over NS-3 using DCE and the AT&T topology. It establishes a non-adversarial baseline before measuring attack and countermeasure effects.
- Simulation platform: The experiments run CCNx over NS-3 through DCE to quantify the effects of interest flooding attacks and countermeasures.DCE enables testing the latest CCNx code without reimplementing it for NS-3.
- Simulation assumptions: The simulated NDN deployment uses an IP overlay, reflecting the status of the current CCNx implementation and the official NDN testbed.Links between routers are described as GRE tunnels carrying UDP packets.
- Topology and workload: The experiments use the AT&T network topology with 16 honest consumers and 2 producers, while varying adversarial traffic in subsequent evaluations.The baseline uses distinct nonexistent content, a 120 KB PIT size, and a 4-second interest expiration timeout.
- Reported measures: Figure 2 reports average results across runs, showing total content received by routers and PIT usage over simulation time.The PIT-usage axis reaches the 120 KB capacity, and vertical markers indicate when consumers start and stop sending interests.
V. ATTACK EFFECTIVENESS
The paper demonstrates that a small number of adversarial consumers can launch an interest flooding attack with little bandwidth, significantly reducing network performance through PIT exhaustion.
- The experiments exclude adversarial control of routers, leaving attacks originating from internal routers for future work.
- Three adversarial nodes send interests for non-existent content toward producer P0, using fake interests generated every 1.337 ms.
- Several routers forward only 20% of the original traffic during the attack.
- Router forwarding varies between 25% and 80% of the baseline, despite only three adversaries and consumers distributed across the network.
- Reduced consumer bandwidth is attributed to high PIT usage, with R3 reaching its PIT limit first because of its central topology position.
VI. OUR COUNTERMEASURE: POSEIDON
Poseidon is a collaborative push-back framework that detects interest flooding through traffic anomalies and mitigates it by filtering offending interfaces and issuing alerts.
- Detection may be local, using router metrics, or collaborative, using state exchange among nearby routers.
- Poseidon monitors per-interface rates of unsatisfied interests relative to overall traffic and detects significant changes between consecutive intervals.
- When an anomaly is detected, Poseidon filters offending interfaces to reduce incoming interests and can send push-back alerts to those interfaces.
- Poseidon records namespace and incoming/outgoing interface information for expired interests.
A. Detection Phase
Poseidon detects interest flooding by combining short-term interest-satisfaction measurements with PIT usage, reducing false positives while retaining sensitivity to low-rate attacks. Thresholds and observation intervals trade detection speed against robustness to benign bursts.
- Detection metrics: Poseidon measures incoming interests relative to outgoing content packets on each router interface.The detection algorithm runs at fixed intervals, typically every 60 ms, and during specified push-back events.
- Detection trade-offs: Short benign bursts can resemble attacks, so thresholds and observation intervals must balance false positives against late or missed detection.Longer intervals may reduce sensitivity to short bursts, while increasing detection thresholds can significantly increase detection time.
- Detection metrics: PIT occupancy complements traffic-rate measurements by capturing how much state each interface’s interests consume.This monitors attack effects as well as their immediate traffic causes.
- Detection logic: Using both metrics keeps false positives low compared with relying only on interest-to-content ratios and enables detection of low-rate flooding.Low-rate attackers can keep the traffic ratio below its threshold, while PIT monitoring exposes the resulting state usage.
- Detection trade-offs: To evade detection, an adversary must either reduce its interest rate or restrict flooding to short bursts, limiting attack effectiveness.These constraints follow from jointly monitoring unsatisfied interests and PIT usage.
B. Reaction Phase
Poseidon reacts to detected interest flooding by rate-limiting offending interfaces and propagating signed push-back alerts. This lets routers nearer the adversary detect and suppress malicious traffic before it reaches the intended victim.
- Local reaction: After identifying flooding on an interface, Poseidon limits incoming-interest rates and restores the original rate after metrics fall below thresholds.The reaction is therefore reversible when the detected condition clears.
- Collaborative reaction: Collaborative push-back sends signed unsolicited content alerts carrying the reduced rate and attack information.Content packets are used because the next-hop PIT may be full and signatures authenticate alerts.
- Collaborative reaction: Persistent attacks trigger repeated alerts that progressively lower upstream thresholds until routers detect and rate-limit malicious interests.Thresholds are restored after a predefined period without reported attacks.
- Collaborative reaction: Push-back enables uninvolved forwarding routers to detect attacks early, including routers close to adversary-controlled nodes.This places countermeasures nearer the attack source, where the paper states they are most effective.
VII. EVALUATION
The evaluation uses CCNx over NS-3 simulations with fixed detection and push-back parameters. Both local rate limiting and distributed push-back improve content delivery under attack, with push-back providing the stronger gains.
- Experimental setup: The experiments implement Poseidon’s detection and reaction algorithms in the same topology used for the attack experiments.The setup uses initial thresholds, scaling factor s = 2, and a 60 ms wait time.
- Experimental setup: Figure 5 compares content-packet ratios under attack without countermeasures, with local rate limiting, and with push-back.The evaluation also reports PIT usage and time-varying throughput.
- Local countermeasures: Under attack, local countermeasures improve performance by about 50% for most routers versus attack without countermeasures.The attack reduces content traffic by about 50% with local mitigation, compared with about 80% without countermeasures; detection takes around one second.
- Distributed countermeasures: Push-back improves performance over local rate limiting by over 300% for several routers.The distributed method also substantially reduces PIT usage compared with local mitigation.
- Distributed countermeasures: With push-back, router R4 provides roughly the same throughput measured without interest flooding.The evaluation also observes cyclical bandwidth availability as expired fake interests release PIT space.
VIII. RELATED WORK
Related work covers conventional Internet DDoS attacks, NDN-specific threats, cache pollution, alternative interest-flooding countermeasures, and complementary evaluations using different implementations.
- Prior DDoS work: Prior Internet research addresses routing attacks, packet flooding, reflection, DNS cache poisoning, SYN flooding, and multiple detection or filtering strategies.These strategies include anomaly detection, packet filtering, traceback, and collaborative defenses.
- NDN security research: NDN-related work includes attack taxonomies, cache-pollution defenses, and analyses of resource exhaustion, mobile blockade, and state decorrelation.CacheShield proactively avoids caching unpopular content, while another approach reactively detects cache pollution.
- Interest-flooding studies: Independent work confirms the feasibility of interest flooding and the need for effective countermeasures.That work is described as complementary in attack evaluation and mitigation.
- Interest-flooding studies: The paper evaluates interest flooding using the official NDN implementation, whereas the independent study uses NDNsim.The authors argue that actual NDN code may provide a more accurate assessment.
- Alternative countermeasures: Another proposed defense relies on collaboration between routers and producers responsible for namespaces targeted by fake interests.This differs from the paper’s described router-based push-back approach.
IX. CONCLUSION
The paper establishes interest flooding as a realistic DDoS threat to NDN and introduces Poseidon to detect and mitigate it using local and collaborative techniques.
- The experiments provide the paper’s first experimental evaluation of interest flooding-based DDoS over NDN, using the official NDN implementation codebase.The authors argue this setup reliably approximates physical, non-simulated network behavior.
- An adversary with limited resources can reduce bandwidth allocated to content objects to 15-25% of total bandwidth.
- Poseidon detects and mitigates interest flooding through local metrics and collaborative techniques for early detection.
- During attacks, most routers running Poseidon can use more than 80% of available bandwidth.