Retracted: Interest Flooding Attack Detection Method in NDN Networks

Named Data Networking (NDN) is a new network architecture derived from the success of the Internet. Specifically, NDN addresses and identifies data by naming. Source and destination host addresses are not required for data communication in the NDN because the data is uniquely named instead. In the NDN network, the Forwarding Information Base (FIB) table is responsible for data forwarding, the Pending Interest Table (PIT) is liable for holding the state of data forwarding process, and the Content Store (CS) is used to stock data chunks within the network to optimize the forwarding time to the data without contacting to the content producer. All these data structures consume the memory of devices existing in the Named Data Networking of Things (NDNoT). Accordingly, the size of the FIB, PIT and CS needs to be carefully adjusted in NDNoT environments for performance tuning and Quality of Service (QoS) provisioning. In this study, we explore the issues of FIB sizing on average and maximum occupancy, reliability and maximum delay for constant bit rate (CBR) traffic where each content producer is addressed with a prefix name in the Cooja simulator environment. The results indicate that FIB table size has an impact on the reliability and maximum delay. During the number of records in FIB outpaces the count of nodes in the network, the reliability decreases gradually. Therefore, in constrained NDNoT environment careful allocation of the memory among FIB, PIT and CS becomes an important issue. According to our knowledge so far, this work is the first study showing the effect of FIB table on the performance in an NDNoT environment.

Named Data Networking (NDN) is a newly proposed next-generation Internet architecture that uses the name of data to forward and route packets. As a potential candidate for future Internet architecture, it is crucial to address the security and privacy issues in NDN. NDN is vulnerable to a new type of Distributed Denial of Service (DDoS) attacks called Interest Flooding Attacks (IFAs). The attackers can send a massive amount of Interest requests to overwhelm the Pending Interest Table (PIT) at routers resulting in network disruption for legitimate users. In this paper, we propose a Binary Tree-Based Interest Flooding Attack Detection and Mitigation Scheme (BTIFADMS) to protect NDNs. The proposed scheme allows each NDN router to use binary trees to detect IFAs and mitigates IFAs by limiting the number of Interest requests forwarded from the contaminated routers. The simulation evaluation shows that BTIFADMS can quickly and accurately identify and respond to the IFAs in the NDNs.

The large expansion in network services and applications seen in the last few years requires new network architectures to satisfy an increasing number of users and enhance content delivery. Named Data Networking (NDN) has recently appeared as a new paradigm to solve many shortcomings in the current TCP/IP architecture. Its main characteristics like stateful forwarding and in-network caching made NDN networks an efficient environment for data delivery where the data is retrieved based on content names rather than IP addresses. The NDN, by its nature, defends against the well-known Distributed Denial of Service (DDoS) attacks that take place in the traditional TCP/IP architecture. However, a special kind of DoS attack called Collusive Interest Flooding Attack (CIFA) has appeared to overwhelm the resources of NDN routers by filling their Pending Interest Tables (PIT) with long-lasting malicious entries. The network throughput and consumer satisfaction rate are highly affected by CIFA. A lightweight yet efficient stateless CIFA detection algorithm is proposed in this research utilizing the non-parametric CUSUM algorithm; a change point detection approach that detects the point in time when a transition occurs in the network. The proposed algorithm is characterized by its low computational overhead, highly accurate detection, and quick response. To detect the malicious name prefixes and eliminate the CIFA effect, a mitigation algorithm that uses the average response time vales of all name prefixes is proposed in this research. Experimental results show that this approach detects CIFA after 199.5 ms from when an attack is launched in the large-scale topology. In addition, the mitigation approach effectively reduces the PIT utilization and increases the average consumer satisfaction rate.

Named data networking (NDN) supports receiver-driven content retrieval with stateful forwarding (pending interest table (PIT)/forwarding information base) and in-network caching, yet many deployments still rely on classical cryptography that may be undermined by quantum-capable adversaries. Despite NDN’s built-in data authenticity via producer signatures, quantum-enabled attacks become plausible once RSA/ECC-based trust anchors are weakened by Shor-type attacks. Existing quantum-security efforts for NDN largely focus on post-quantum replacements of signatures or key exchange, but do not address the tension between confidentiality-preserving payload protection and NDN’s in-network processing (forwarding/caching decisions) in a quantum setting. This paper presents a quantum-enhanced NDN architecture that preserves NDN’s content-centric semantics—naming, PIT-driven forwarding, and cache-assisted dissemination of verifiable control objects—while delivering privacy-sensitive payloads as quantum homomorphic encryption (QHE)-encrypted quantum states over an underlying quantum network. QHE provides end-to-end confidentiality and enables authorized operations on encrypted quantum payloads without exposing plaintext. To make the design compatible with NDN forwarding, the proposed protocol encrypts the payload while keeping name-based forwarding semantics intact, and supports ciphertext-domain processing for selected policy functions. To protect provenance and integrity of NDN metadata, routing instructions, and session state, we incorporate quantum digital signatures (QDS) bound to NDN names and session identifiers. The main contributions are: (i) a QHE+QDS layered protection model tailored to NDN’s Interest and Data exchange; (ii) a session workflow that couples proactive entanglement distribution with NDN-style stateful signaling for efficient establishment and recovery; and (iii) a security analysis clarifying the achieved guarantees and the remaining trust assumptions. Security analysis indicates robustness against quantum man-in-the-middle and tampering attacks, with modest overhead on NDN control traffic.

As a key component in implementing Named Data Networking (NDN), Pending Interest Table (PIT) requires an efficient exact-matching algorithm for a scalable and fast PIT lookup. A Bloom filter (BF) is a memory-efficient data structure for performing exact matching operations. In this paper, three different BF-based PIT architectures are proposed: PIT using functional Bloom filters (FBF-PIT), PIT using counting Bloom filters with return values (rCBF-PIT), and a refined rCBF-PIT with signatures (R-rCBF-PIT). The proposed BF-based PITs incrementally allocate a new BF for storing multiple incoming faces of Interest packets with the same content name. For a Data packet lookup, the proposed PIT architectures simultaneously access every BF structure to find matching faces and delete the faces (i.e., matching Interest packet information). The functional Bloom filter (FBF) used in an FBF-PIT is a key-value data structure that stores values only without keys. However, because the number of non-reusable conflict cells in the FBF increases as the number of stored packets increases in the FBF-PIT, the indeterminable rate increases. To decrease the indeterminable rate, we propose the rCBF-PIT, which uses counting Bloom filters with return values (rCBFs), allowing reusable conflict cells. False positives for Interest packets lead to incorrect deletions that can cause false negatives for incoming Data packets. Because most of the false positives occur in the first BF structure, we finally propose the R-rCBF-PIT, in which the first rCBF is replaced with an rCBF with a signature field. The proposed PITs also provide an aging mechanism using a valid bit and a hit bit for entry expiration. Simulation results show that rCBF-PIT and R-rCBF-PIT both reduce the indeterminable rate by more than 81% compared with FBF-PIT. The results also show that R-rCBF-PIT resolves false negatives caused by incorrect deletions by including the signature fields in the first rCBF.

Named Data Networking (NDN) is a recently designed Internet architecture that benefits data names instead of locations and creates essential changes in the abstraction of network services from "delivering packets to specific destinations” to "retrieving data with special names" makes. This fundamental change creates new opportunities and intellectual challenges in all areas, especially network routing and communication, communication security, and privacy. The focus of this dissertation is on the forwarding aircraft feature introduced by NDN. Communication in NDN is done by exchanging interest and data packets. Consumers send interest packets to request data, routers send them based on the data prefix name, and manufacturers respond with data packets exactly how interest is received. During this process, routers maintain information about the status of suspended interests. As regards NDN is still in its early stage, none of these strong efficiency features have done systematically designed, measured, or tracked in data retrieval and multi-path detection. This paper tries to improve transport performance by combining label switching with adaptive transport methods. For this purpose, in addition to RTT, another timer called T is used, an RTT factor for interface rating. And uses the BDP to choose the best interface to respond to interest. During this process, response time, throughput, and data recovery time are improved by 12%, 10%, and 5%, respectively.

Using Interests (requests that elicit content) and maintaining per-Interest forwarding state in Pending Interest Tables (PIT) are integral to the design of the Named Data Networking (NDN) and Content-Centric Networking (CCNx) architectures. However, using PITs makes the network vulnerable to Interest-flooding attacks, and PITs can become very large. It is shown that in-network caching eliminates the need for Interest aggregation and obviates the use of PITs. A new approach to content-centric networking (CCN-GRAM) is introduced that provides all the benefits of NDN and CCNx, eliminates the use of PITs by means of anonymous datagrams, and is immune to Interest-flooding attacks. Routers maintain routes to the anonymous origins of Interests using an on-demand routing approach in the data plane that can also be used to provide native support for multicasting in the dat a plane. Simulation experiments show that the number of forwarding entries required in CCN-GRAM is orders of magnitude smaller than the number of PIT entries.

Radient: Scalable, memory efficient name lookup algorithm for named data networking

International audience

Named Data Networking (NDN) is considered as a prominent architecture towards future Wireless Local Area Networks (WLAN), and multicast plays an important role in data delivery such as media streaming, multipoint videoconferencing, etc. However, to achieve high-efficiency multicast in NDN WLAN is challenging for two significant reasons. First, without feedback mechanism in IEEE 802.11 standards, to guarantee reliability, the current multicast scheme transmits the multicast data with the basic rate (e.g., 1 Mbps for IEEE 802.11b), which inevitably increases the transmission delay for high-speed consumers. Second, as a NDN multicast group is constituted by consumers who are requesting the same content, multicast groups are easy to form and evolve rapidly, where a data rate adaptation scheme is requisite to accommodate differential multicast groups. In this paper, we propose a multi-stage multicast rate adaptation scheme for NDN WLAN, named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NDN-MMRA</i> , to minimize the total transmission time with reliability guarantee for multicast group members. In <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NDN-MMRA</i> , by checking the Pending Interest Table (PIT) status information, the number of consumers in each multicast group as well as their receiving capabilities are known ahead; with the available data rates in a specific 802.11 standard, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NDN-MMRA</i> determines: 1) how many transmission stages are required; and 2) in each stage, which data rate should be adopted. The merit is that with multi-stage transmissions, the data rate can be adapted in descending order to accommodate high-speed consumers with delay minimized, and low-speed consumers with reliability guaranteed. We implement <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NDN-MMRA</i> in NS-3 by adopting the ndnSIM module, and conduct extensive experiments to demonstrate its efficacy under different IEEE 802.11 standards and various underlying WLAN topologies.

The Named Data Network (NDN) is a future network architecture to transit conventional host-centric networks into data-centric networks. A routing attack, represented by Interest Flooding Attack (IFA), is a major security concern in NDNs. IFAs seriously harm NDNs by sending excessive fallacious Interest packets to overwhelm the routers to serve legitimate users. It is easy to launch, but difficult to defend, especially when legitimate Interest packets are blended with the IFAs as bIFAs. In this paper, we propose an accurate approach to detect and mitigate IFAs and bIFAs, named Accurate Detection and Mitigation of Blended Interest Flooding Attacks (ADMBIFA). It utilizes fuzzy logic to detect IFAs and bIFAs. And then it identifies malicious Interest prefixes with K-means. Finally, it restrains attackers to mitigate the damage to the networks. The simulation results show that the ADMBIFA is very sensitive to detect attacks with an ability to mitigate IFAs and bIFAs. And it can effectively reduce the negative impacts on NDNs.

Content-Centric Networking (CCN) is a communication paradigm that emphasizes content distribution. Named-Data Networking (NDN) is an instantiation of CCN, a candidate Future Internet Architecture. NDN supports human-readable content naming and router-based content caching which lends itself to efficient, secure, and scalable content distribution. Because of NDN's fundamental requirement that each content object must be signed by its producer, fragmentation has been considered incompatible with NDN since it precludes authentication of individual content fragments by routers. The alternative is to perform hop-by-hop reassembly, which incurs prohibitive delays. In this paper, we show that secure and efficient content fragmentation is both possible and even advantageous in NDN and similar content-centric network architectures that involve signed content. We design a concrete technique that facilitates efficient and secure content fragmentation in NDN, discuss its security guarantees and assess performance. We also describe a prototype implementation and compare performance of cut-through with hop-by-hop fragmentation and reassembly.

Detecting interest flooding attacks in NDN: A probability-based event-driven approach

&lt;p class="JESTECAbstract"&gt;Content Centric Networking (CCN) is a modern architecture that got wide attention in the current researches as a substitutional for the current IP-based architecture. Many studies have been investigated on this novel architecture but only little of them focused on Pending Interest Table (PIT) which is very important component in every CCN router. PIT has fundamental role in packet processing in both upstream process (Interest packets) and downstream process (Data packets). PIT must be fast enough in order to not become an obstruction in the packet processing and also it must be big enough to save a lot of incoming information. In this paper, we suggest a new PIT design and implementation named CF-PIT for CCN router. Our PIT design depends on modifying and utilizing an approximate data structure called Cuckoo filter (CF). Cuckoo filter has ideal characteristics like: high insertion/query/deletion performance, acceptable storage demands and false positive probability which make it with our modification convenient for PIT implementation. The experimental results showed that our CF-PIT design has high performance in different side of views which make it very suitable to be implemented on CCN routers.&lt;/p&gt;

Ahstract-Content-Centric Networking (CCN) is an emerging Internet paradigm where the content is treated as the first-class citizen and content names are used for network layer communication instead of IP addresses. Use of CCN in wireless environment can cause various issues such as re-transmissions, collisions, delay and link failure. One of the key issues that affects the performance of CCN is the management of Pending Interest Table (PIT). PIT stores each broadcasted Interest packet forwarded upstream towards the content provider and is purged either when the requested content is returned or the PIT Entry Lifetime (PEL) expires. The conventional method in CCN for PEL does not considering the network impairments such as channel error, and congestion. As a result, timeout occurs, and Interest packets are re-transmitted for the chunks that have been dropped or delayed. Due to limited size of storage in wireless CCN, all new incoming Interest packets (including retransmissions) affect the performance of network by bloating PIT. In this paper, therefore, we propose a scheme that purges the PIT entries quickly by prefetching the un-obtained content in advance. Simulation results show that proposed protocol performs better as comparing with the conventional CCN and another recent proposed protocol.