Detecting and Mitigating Collusive Interest Flooding Attacks in Named Data Networking

Named Data Networking (NDN) is a newly proposed next-generation Internet architecture that uses the name of data to forward and route packets. As a potential candidate for future Internet architecture, it is crucial to address the security and privacy issues in NDN. NDN is vulnerable to a new type of Distributed Denial of Service (DDoS) attacks called Interest Flooding Attacks (IFAs). The attackers can send a massive amount of Interest requests to overwhelm the Pending Interest Table (PIT) at routers resulting in network disruption for legitimate users. In this paper, we propose a Binary Tree-Based Interest Flooding Attack Detection and Mitigation Scheme (BTIFADMS) to protect NDNs. The proposed scheme allows each NDN router to use binary trees to detect IFAs and mitigates IFAs by limiting the number of Interest requests forwarded from the contaminated routers. The simulation evaluation shows that BTIFADMS can quickly and accurately identify and respond to the IFAs in the NDNs.

As a key component in implementing Named Data Networking (NDN), Pending Interest Table (PIT) requires an efficient exact-matching algorithm for a scalable and fast PIT lookup. A Bloom filter (BF) is a memory-efficient data structure for performing exact matching operations. In this paper, three different BF-based PIT architectures are proposed: PIT using functional Bloom filters (FBF-PIT), PIT using counting Bloom filters with return values (rCBF-PIT), and a refined rCBF-PIT with signatures (R-rCBF-PIT). The proposed BF-based PITs incrementally allocate a new BF for storing multiple incoming faces of Interest packets with the same content name. For a Data packet lookup, the proposed PIT architectures simultaneously access every BF structure to find matching faces and delete the faces (i.e., matching Interest packet information). The functional Bloom filter (FBF) used in an FBF-PIT is a key-value data structure that stores values only without keys. However, because the number of non-reusable conflict cells in the FBF increases as the number of stored packets increases in the FBF-PIT, the indeterminable rate increases. To decrease the indeterminable rate, we propose the rCBF-PIT, which uses counting Bloom filters with return values (rCBFs), allowing reusable conflict cells. False positives for Interest packets lead to incorrect deletions that can cause false negatives for incoming Data packets. Because most of the false positives occur in the first BF structure, we finally propose the R-rCBF-PIT, in which the first rCBF is replaced with an rCBF with a signature field. The proposed PITs also provide an aging mechanism using a valid bit and a hit bit for entry expiration. Simulation results show that rCBF-PIT and R-rCBF-PIT both reduce the indeterminable rate by more than 81% compared with FBF-PIT. The results also show that R-rCBF-PIT resolves false negatives caused by incorrect deletions by including the signature fields in the first rCBF.

Named data networking (NDN) supports receiver-driven content retrieval with stateful forwarding (pending interest table (PIT)/forwarding information base) and in-network caching, yet many deployments still rely on classical cryptography that may be undermined by quantum-capable adversaries. Despite NDN’s built-in data authenticity via producer signatures, quantum-enabled attacks become plausible once RSA/ECC-based trust anchors are weakened by Shor-type attacks. Existing quantum-security efforts for NDN largely focus on post-quantum replacements of signatures or key exchange, but do not address the tension between confidentiality-preserving payload protection and NDN’s in-network processing (forwarding/caching decisions) in a quantum setting. This paper presents a quantum-enhanced NDN architecture that preserves NDN’s content-centric semantics—naming, PIT-driven forwarding, and cache-assisted dissemination of verifiable control objects—while delivering privacy-sensitive payloads as quantum homomorphic encryption (QHE)-encrypted quantum states over an underlying quantum network. QHE provides end-to-end confidentiality and enables authorized operations on encrypted quantum payloads without exposing plaintext. To make the design compatible with NDN forwarding, the proposed protocol encrypts the payload while keeping name-based forwarding semantics intact, and supports ciphertext-domain processing for selected policy functions. To protect provenance and integrity of NDN metadata, routing instructions, and session state, we incorporate quantum digital signatures (QDS) bound to NDN names and session identifiers. The main contributions are: (i) a QHE+QDS layered protection model tailored to NDN’s Interest and Data exchange; (ii) a session workflow that couples proactive entanglement distribution with NDN-style stateful signaling for efficient establishment and recovery; and (iii) a security analysis clarifying the achieved guarantees and the remaining trust assumptions. Security analysis indicates robustness against quantum man-in-the-middle and tampering attacks, with modest overhead on NDN control traffic.

Named Data Networking (NDN) is a new network architecture derived from the success of the Internet. Specifically, NDN addresses and identifies data by naming. Source and destination host addresses are not required for data communication in the NDN because the data is uniquely named instead. In the NDN network, the Forwarding Information Base (FIB) table is responsible for data forwarding, the Pending Interest Table (PIT) is liable for holding the state of data forwarding process, and the Content Store (CS) is used to stock data chunks within the network to optimize the forwarding time to the data without contacting to the content producer. All these data structures consume the memory of devices existing in the Named Data Networking of Things (NDNoT). Accordingly, the size of the FIB, PIT and CS needs to be carefully adjusted in NDNoT environments for performance tuning and Quality of Service (QoS) provisioning. In this study, we explore the issues of FIB sizing on average and maximum occupancy, reliability and maximum delay for constant bit rate (CBR) traffic where each content producer is addressed with a prefix name in the Cooja simulator environment. The results indicate that FIB table size has an impact on the reliability and maximum delay. During the number of records in FIB outpaces the count of nodes in the network, the reliability decreases gradually. Therefore, in constrained NDNoT environment careful allocation of the memory among FIB, PIT and CS becomes an important issue. According to our knowledge so far, this work is the first study showing the effect of FIB table on the performance in an NDNoT environment.

Radient: Scalable, memory efficient name lookup algorithm for named data networking

Ahstract-Content-Centric Networking (CCN) is an emerging Internet paradigm where the content is treated as the first-class citizen and content names are used for network layer communication instead of IP addresses. Use of CCN in wireless environment can cause various issues such as re-transmissions, collisions, delay and link failure. One of the key issues that affects the performance of CCN is the management of Pending Interest Table (PIT). PIT stores each broadcasted Interest packet forwarded upstream towards the content provider and is purged either when the requested content is returned or the PIT Entry Lifetime (PEL) expires. The conventional method in CCN for PEL does not considering the network impairments such as channel error, and congestion. As a result, timeout occurs, and Interest packets are re-transmitted for the chunks that have been dropped or delayed. Due to limited size of storage in wireless CCN, all new incoming Interest packets (including retransmissions) affect the performance of network by bloating PIT. In this paper, therefore, we propose a scheme that purges the PIT entries quickly by prefetching the un-obtained content in advance. Simulation results show that proposed protocol performs better as comparing with the conventional CCN and another recent proposed protocol.

Using Interests (requests that elicit content) and maintaining per-Interest forwarding state in Pending Interest Tables (PIT) are integral to the design of the Named Data Networking (NDN) and Content-Centric Networking (CCNx) architectures. However, using PITs makes the network vulnerable to Interest-flooding attacks, and PITs can become very large. It is shown that in-network caching eliminates the need for Interest aggregation and obviates the use of PITs. A new approach to content-centric networking (CCN-GRAM) is introduced that provides all the benefits of NDN and CCNx, eliminates the use of PITs by means of anonymous datagrams, and is immune to Interest-flooding attacks. Routers maintain routes to the anonymous origins of Interests using an on-demand routing approach in the data plane that can also be used to provide native support for multicasting in the dat a plane. Simulation experiments show that the number of forwarding entries required in CCN-GRAM is orders of magnitude smaller than the number of PIT entries.

The current Internet infrastructure, initially conceived to provide closed group connectivity to a limited user-base, is now facing the challenges of catering to over three billion users with dynamically changing data, transport, and access requirements. Content-Centric Networking (CCN) is being explored as a possible future Internet architecture. Named-Data Networking (NDN) exemplifies CCN and with the ever-changing security landscape, it is imperative to build it with intrinsic resilience based on the security by design narrative. In this extended abstract, we explore the fake interest fiooding by adversaries to launch a Distributed Denial of Service (DDoS) attack in NDN. We propose Kiram as an intelligent anomaly recognition and alert generation mechanism serving as a collaborative countermeasure to a DDoS attack. The alert generated by Kiram is named Warding Off Evil (WOE). This poster presents results establishing the effectiveness of Kiram based on substantial simulations over a fairly realistic topology.

To viably identify interest flooding assault (IFA) in Named Data Networking (NDN), this paper proposes a discovery technique for interest flooding assault dependent on chi-square test and similitude test. Initially, it decides the identification window size dependent on the dissemination of data name prefixes (that is data entropy) in the current organization traffic. The assailants might annex subjective irregular suffix to a certain prefix in the organization traffic, and afterward send an enormous number of interest parcels that can't get the reaction. Focused on at this issue, the affectability of chi-square test is utilized to distinguish the difference in pre-fix of interest parcels. Premium parcels started by IFA assailants are generally joined to a genuine prefix, yet with an arbitrarily created suffix appended. Considering of this issue, the similitude of interest parcel prefixes is additionally identified. At long last, the location consequences of the two viewpoints are consolidated to hinder mine if interest flooding assault has happened. Moreover, as indicated by the symmetric steering normal for Pending Interest Table (PIT), likewise the fashioned interest parcel will be sent back to the aggressor, and afterward confine the corresponding port of the assailant, to viably smother the IFA assault. The test results show that the proposed technique cannot just identify IFA in NDN toward the start of the assault, yet in addition is more precise and powerful than different strategies.

Named Data Networking (NDN) has emerged as a promising information-centric networking paradigm that addresses the limitations of the traditional IP-based Internet architecture. The core principle of NDN relies on content naming instead of host addressing, to provide efficient, secure, and scalable content delivery. Routing is a critical component of NDN and is responsible for discovering and maintaining optimal paths to named content. This paper presents a comprehensive review of routing techniques in NDN, focusing on the design principles, algorithms, and performance metrics, especially in wired network architecture. We first summarize the NDN architecture and discuss its key components. We then delve into the fundamental routing concepts in NDN and categorize and examine various routing techniques, including link state, distance vector, and centralized approaches based on Software Defined Network. We also summarize the relevant research efforts proposed to address NDN routing challenges by focusing more on wired network architecture. Finally, we identify open research issues and future directions in NDN routing, emphasizing the need for scalable, efficient, and secure routing techniques that can fulfill the growing demands of the modern Internet. In conclusion, this review serves as a valuable reference for researchers and practitioners in NDN, offering a comprehensive understanding of the current state-of-the-art routing techniques, limitations, and potential future advancements.

International audience

Named Data Networking (NDN) is one of the strong competitors of the next generation network architecture, meeting the needs of today’s users for the network. One problem with NDN is that the content requester does not know if there is any content in the network when it sends out the interest package, and it does not know where the target is. This problem is currently solved by the domain name resolution service, but the existing solution does not apply to the NDN architecture. Because the content in the NDN is identified by a human-readable name, the NDN architecture does not require an additional name resolution system. In this paper, we propose a blockchain-based Content Name Search Mechanism (BCNSM) by binding the content producer and the human-readable content name as the unique identifier of the content, and then using the blockchain as a trusted organization to store content information, and dynamically stores the information through the smart contract, thereby mapping the content name and the storage location to each other. BCNSM provides users with content name search services and name to the content provider resolution services. Then the model was built for the BCNSM using the colored petri net, and the model process is verified by the model simulation to meet the expectations, and the state space analysis proves that the BCNSM has no deadlock. Finally, a prototype of the smart contract was implemented in Ethereum’s testnet, and the storage and Gas overhead of content name registration and content cache address update were tested.

Named Data Networking (NDN) is considered as a prominent architecture towards future Wireless Local Area Networks (WLAN), and multicast plays an important role in data delivery such as media streaming, multipoint videoconferencing, etc. However, to achieve high-efficiency multicast in NDN WLAN is challenging for two significant reasons. First, without feedback mechanism in IEEE 802.11 standards, to guarantee reliability, the current multicast scheme transmits the multicast data with the basic rate (e.g., 1 Mbps for IEEE 802.11b), which inevitably increases the transmission delay for high-speed consumers. Second, as a NDN multicast group is constituted by consumers who are requesting the same content, multicast groups are easy to form and evolve rapidly, where a data rate adaptation scheme is requisite to accommodate differential multicast groups. In this paper, we propose a multi-stage multicast rate adaptation scheme for NDN WLAN, named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NDN-MMRA</i> , to minimize the total transmission time with reliability guarantee for multicast group members. In <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NDN-MMRA</i> , by checking the Pending Interest Table (PIT) status information, the number of consumers in each multicast group as well as their receiving capabilities are known ahead; with the available data rates in a specific 802.11 standard, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NDN-MMRA</i> determines: 1) how many transmission stages are required; and 2) in each stage, which data rate should be adopted. The merit is that with multi-stage transmissions, the data rate can be adapted in descending order to accommodate high-speed consumers with delay minimized, and low-speed consumers with reliability guaranteed. We implement <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NDN-MMRA</i> in NS-3 by adopting the ndnSIM module, and conduct extensive experiments to demonstrate its efficacy under different IEEE 802.11 standards and various underlying WLAN topologies.

Information-Centric Networking (ICN) is a new communication paradigm that replaces the host addresses by the name of content; Named Data Networking (NDN) is a promising ICN architecture that has attracted research attention in recent years. NDN is a receiver-driven architecture implements pull-based communication in the form of one-interest-one-data. This model poses different challenges, especially from the transport layer perspective. In contact to IP-based networks where the congestion is handled in an end-to-end manner, NDN cannot apply the same concept, while most of the existing solutions are based on hop-by-hop connection. In this paper, we present a new congestion control mechanism for NDN based on link quality estimation. We focus our efforts to provide fast data transmission, decrease packet dropping rate, and maximize the link utilization. The simulation results show that our solution outperforms the NDN schemes in terms of throughput and drop packets.

Distributed Denial of Service (DDoS) attack is a serious threat to commercial service network. DDoS attack has been studied for years. However, detecting and relieving DDoS attacks are still a problem. Especially, nowadays more and more DDoS attacks produce heavy network traffic, it is hard to response rapidly because that needs high processing performance to process massive traffic data. With big data technology, volumes of network traffic data can be processed much faster. Apache Spark can process a great amount of data in a reasonable time so that DDoS attack can be detected in time. Besides, it is difficult to modify the network configuration in traditional network. With Software-Defined Networking (SDN), a new paradigm in networking, networking can be controlled by programs, which makes modifying the network configuration easier. In this paper, a DDoS detection and mitigation system framework in SDN is introduced, a framework that can control network based on analyzing the network traffic data. Comparing to the traditional defense methods of DDoS attack, the framework can response to DDoS attack by rules automatically.