An EWMA-Based Mitigation Scheme Against Interest Flooding Attacks in Named Data Networks

Interest Flooding Attacks (IFA) pose a significant threat to Named Data Networking (NDN) by inundating the network with forged or malicious requests. These malicious Interest packets overwhelm the Pending Interest Table (PIT) leading to disruptive forwarding scenarios. The blending of low-frequency concurrent IFA with legitimate Interest packets, called bIFA, renders existing detection methodologies ineffective. This paper presents a scheme that aggregates the Exponential Weighted Moving Average (EWMA) and the Logistic Regression algorithms to mitigate IFA/bIFA in the phases of attack detection and malicious prefixes identification. Mitigation is achieved through the collaboration of routers, working at the granularity of per-prefix-per-interface, by taking advantage of the prefix statistics at each router. Simulation results illustrate the proposed scheme’s high sensitivity to attacks and its effectiveness in mitigating the attacker's impact in reducing the potential of network disruption.