Abstract
The emerging link flooding attacks (LFAs) increasingly attract significant attention in both academia and industry, due to their huge threat to the routing infrastructure. Compared with traditional distributed denial-of-service attacks (DDoS) that target servers, LFAs target critical links. Stemming from coordinated flows between bots and public servers or among bots, the attack traffic flows are aggregated at a critical link, thereby gradually making a network connected to the critical link disconnected as the aggregated attack traffic flows grow intensified. It is commonly believed that LFAs are far more sophisticated than traditional DDoS attacks. Nevertheless, whether such sophistication comes without a downside has never been investigated. In this paper, we advance the notion of strike precision of LFAs, and reveal that LFAs may exhibit attack interference which might restrict their applicability from the adversary’s standpoint. Due to attack interference, strike precision of LFAs would be lowered. That is, while disconnecting a network, LFAs may unexpectedly interfere the connectivity of innocent networks nearby, undermining the stealthiness and persistence of LFAs. We tackle a series of questions surrounding strike precision, for fostering more research concerning the practical aspects of LFAs.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
Unless otherwise stated, we remove the subscript j representing the number of generations, for the simplicity of representation.
References
Albert, R., Jeong, H., Barabási, A.L.: Error and attack tolerance of complex networks. Nature 406(6794), 378 (2000)
Bright, P.: Can a ddos break the internet? (2013). http://goo.gl/oM6XJt
Gkounis, D., Kotronis, V., Liaskos, C., Dimitropoulos, X.: On the interplay of link-flooding attacks and traffic engineering. ACM SIGCOMM Comput. Commun. Rev. 46(2), 5–11 (2016)
Hirayama, T., Toyoda, K., Sasase, I.: Fast target link flooding attack detection scheme by analyzing traceroute packets flow. In: Proceedings of IEEE WIFS, pp. 1–6 (2015)
Hyun, Y.: Caida Monitors: The Archipelago Measurement Infrastructure (2009)
Jing, J., Li-dong, M., Shu-ling, L., Lin, J.: Simulation research based on a self-adaptive genetic algorithm. In: Proceedings of IEEE ICIS, pp. 267–269 (2010)
Kang, M.S., Gligor, V.D.: Routing bottlenecks in the internet: causes, exploits, and countermeasures. In: Proceedings of ACM SIGSAC, pp. 321–333 (2014)
Kang, M.S., Gligor, V.D., Sekar, V.: SPIFFY: Inducing cost-detectability tradeoffs for persistent link-flooding attacks. In: Proceedings of NDSS, pp. 1–15 (2016)
Kang, M.S., Lee, S.B., Gligor, V.D.: The crossfire attack. In: Proceedings of IEEE S&P, pp. 127–141 (2013)
Lee, S.B., Kang, M.S., Gligor, V.D.: CoDef: collaborative defense against large-scale link-flooding attacks. In: Proceedings of ACM CoNEXT, pp. 417–428 (2013)
Lipowski, A., Lipowska, D.: Roulette-wheel selection via stochastic acceptance, pp. 2193–2196. CoRR abs/1109.3627 (2012)
Luo, X., Chang, R.K.: On a new class of pulsing denial-of-service attacks and the defense. In: Proceedings of NDSS (2005)
Luo, X., Chang, R.K.: Optimizing the pulsing denial-of-service attacks. In: Proceedings of IEEE DSN, pp. 582–591 (2005)
Ma, X., Li, J., Tang, Y., An, B., Guan, X.: Protecting internet infrastructure against link flooding attacks: a techno-economic perspective. Inf. Sci. (2018, in press)
Magoni, D.: Tearing down the internet. IEEE J. Sel. Areas Commun. 21(6), 949–960 (2003)
Qin, A.K., Suganthan, P.N.: Self-adaptive differential evolution algorithm for numerical optimization. In: Proceedings of IEEE TEVC, pp. 1785–1791 (2005)
Shavitt, Y., Shir, E.: DIMES: let the internet measure itself. ACM SIGCOMM Comput. Commun. Rev. 35(5), 71–74 (2005)
Stoffa, P.L., Sen, M.K.: Nonlinear multiparameter optimization using genetic algorithms: inversion of plane-wave seismograms. Geophysics 56(11), 1794–1810 (1991)
Studer, A., Perrig, A.: The coremelt attack. In: Backes, M., Ning, P. (eds.) ESORICS 2009. LNCS, vol. 5789, pp. 37–52. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-04444-1_3
Tang, Y., Luo, X., Hui, Q., Chang, R.K.: Modeling the vulnerability of feedback-control based internet services to low-rate DoS attacks. IEEE Trans. Inf. Forensics Secur. 9(3), 339–353 (2014)
Wang, C., Miu, T.T., Luo, X., Wang, J.: SkyShield: a sketch-based defense system against application layer DDoS attacks. IEEE Trans. Inf. Forensics Secur. 13(3), 559–573 (2018)
Wang, L., Li, Q., Jiang, Y., Wu, J.: Towards mitigating link flooding attack via incremental SDN deployment. In: Proceedings of IEEE ISCC, pp. 397–402 (2016)
Wang, Y., Xiao, S., Xiao, G., Fu, X., Cheng, T.H.: Robustness of complex communication networks under link attacks. In: Proceedings of ACM ICAIT, p. 61 (2008)
Willinger, W., Roughan, M.: Internet topology research redux. Recent Advances in Networking. ACM SIGCOMM eBook (2013)
Xue, L., Luo, X., Chan, E.W., Zhan, X.: Towards detecting target link flooding attack. In: Proceedings of USENIX LISA, pp. 81–96 (2014)
Xue, L., Ma, X., Luo, X., Chan, E.W., Miu, T.T., Gu, G.: Linkscope: Towards detecting target link flooding attacks. IEEE Trans. Inf. Forensics Secur. 13, 2423–2438 (2018)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
Peng, J., Ma, X., Li, J., Xue, L., Hu, W. (2018). Shoot at a Pigeon and Kill a Crow: On Strike Precision of Link Flooding Attacks. In: Au, M., et al. Network and System Security. NSS 2018. Lecture Notes in Computer Science(), vol 11058. Springer, Cham. https://doi.org/10.1007/978-3-030-02744-5_32
Download citation
DOI: https://doi.org/10.1007/978-3-030-02744-5_32
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-02743-8
Online ISBN: 978-3-030-02744-5
eBook Packages: Computer ScienceComputer Science (R0)