2014 Cooperative-Filter countering Interest

SoftComput(2014)18:1803–1813DOI10.1007/s00500-014-1275-z

FOCUS

Cooperative-Filter:counteringInterest?oodingattacksinnameddatanetworking

KaiWang·HuachunZhou·YajuanQin·HongkeZhang

Publishedonline:10April2014

©Springer-VerlagBerlinHeidelberg2014

AbstractNameddatanetworking(NDN)isanemerg-ingnetworkingparadigmthatisconsideredasoneofthepromisingcandidatesfornext-generationInternetarchitec-ture.TobeaviableInternetarchitecture,NDNmustberesilientagainstcurrentandemergingthreats.ThispaperfocusesonhowtodetectandmitigatetheInterest?ood-ingattack(IFA)inNDN,whichcanexcessivelyconsumetheresourceofeachinvolvedrouterby?oodingtoomanymaliciousInterestpacketswithfakenames.Inthispaper,tocounterIFA,anarchitecturecalledCooperative-Filterisproposed.ItdetectsIFAusingfuzzylogic,andmitigatesitbasedonthecooperationbetweenroutersatthegranular-ityofper-pre?x-per-interface,bytakingadvantagesofthestatestatisticsofeachrouter.Moreover,theperformanceofCooperative-Filterisevaluated,basedonbotheffectofitonreducingmemoryresourceconsumptionofeachinvolved

CommunicatedbyA.Castiglione.

ThisresearchissupportedbytheNationalBasicResearchProgramofChina(“973program”)(2013CB329101),theNationalHigh-TechResearchandDevelopmentProgramofChina(863)

(2011AA010701),theNationalNaturalScienceFoundationofChina(NSFC)(61232017,61271202,61271201,61003283,61102049),BeijingNaturalScienceFoundation(4122060,4132053)andSRFforROCS,SEM(W13C300010).

K.Wang(B)·H.Zhou·Y.Qin·H.Zhang

NationalEngineeringLaboratoryforNextGenerationInternetInterconnectionDevices,BeijingJiaotongUniversity,Beijing100044,China

e-mail:wangkai_bjtu@http://wendang.chazidian.comH.Zhou

e-mail:hchzhou@http://wendang.chazidian.comY.Qin

e-mail:yjqin@http://wendang.chazidian.comH.Zhang

e-mail:hkzhang@http://wendang.chazidian.com

routerandtheeffectonincreasingInterestsatisfactionrateforlegitimateuserswhensufferingIFAaswellasondecreas-ingtheInterest-retrievingdelay.Simulationresultsdemon-stratethatCooperative-FiltercandetectIFAandeffectivelymitigateitsdamageeffectonNDN.Tothebestofourknowl-edge,thisisthe?rstattempttodesignanIFAcountermeasureembeddingwithfuzzylogicaswellascounteringIFAatthegranularityofper-pre?x-per-interface.

KeywordsInterest?oodingattack·Fuzzylogic·Resourceconsumption·Nameddatanetworking

1Introduction

Communicationsandnetworkparadigmoftoday’sInternethasshiftedfromtheconnectionsbetweenhoststotheglobaldistributionandretrievalofcontentinhugeamounts.ThisnewtrendrequiresamajortransformationofcurrentInternetarchitecture,anditleadstotheemergenceofinformation-centricnetworking(ICN)(Koponenetal.2007;Dannewitz2009;Visalaetal.2009;Jacobsonetal.2009,2012;TheCCNprojectteam2010;Lagutinetal.2010;Fotiouetal.2010).OnerepresentativeeffortamongICNresearchesisthenameddatanetworking(NDN)(Jacobsonetal.2009,2012;TheCCNprojectteam2010),whichhasbeenapromisingcandidatefornext-generationInternetarchitecture.

DifferentfromcurrentIP-basedInternet,NDNischar-acterizedbyname-basedroutingandforwarding,andthusnameddataisthe“waist”oftheInternetratherthanphysi-callocations(i.e.,IPaddress).ThecommunicationinNDNisenabledbytwodistincttypesofpackets:Interestpack-etsandDatapackets.Consumersaskfortheirwantedcon-tentbysendingInterestpacketswhichcarrythenameofthedesiredData,andcorrespondingDatapacketsaredeliveredin

123

1804responsetoconsumersonlyupontheseexplicitInterestpack-ets.Tofacilitatename-basedcontentroutingandretrieval,NDNintroducesacontentstore(CS)thatisusedtocacheDatapacketsforpotentialfutureInterestsandapendingInter-esttable(PIT)thatkeepstrackofInterestsforwardedtowardcontentsource(s)intoeveryrouter,withthehelpofthefor-wardinginformationbase(FIB)thatisusedtoguideforward-ingInterestpacketstowardpotentialsource(s)ofmatchingdata.

InNDN,anyonecangenerateastreamofIntereststorequesttheirwantedcontent.IfaNDNrouterhasutilizedallitsPITmemoryresourceforforwardingInterests,itcannolongerforwardanyincomingInterestsfromlegitimateusers.Thus,althoughsecurityisamongthenaturalrequire-mentsofNDN(oneofthekeygoalsofNDNis“securitybydesign”,e.g.,eachcontentitemisboundtoitsnamebycryp-tographicsignatures),unfortunately,itcannotevadesomenetwork-basedsecuritythreatssuchastheInterest?oodingattack(IFA)(Daietal.2013;Gastietal.2012;Widjaja2012).InIFA,attackers?oodexcessivenumberofmaliciousInterestpacketswithfakenamestorequestfornonexistentcontent.WithsomanyfakeInterestpacketspendinginthePITofeachinvolvedrouter,thememoryresourceforPITsoftheserouterswouldbeseverelyexhausted,whichwouldresultindenialofserviceforlegitimateusers.Moreover,thesemali-ciousInterestpacketscanbependinginPITforalongerperiodthanlegitimateones(nolongeratthetimescaleofroundtriptime(RTT),butwaitingtobedeleteduntiltheirPITentriesexpire,whosevalueismorethanRTTandgen-erallyatthetimescaleofthewholelifetimeofeachInterest(Yietal.2013),whichcouldaggravatedenialofserviceforinvolvedusers/consumers.

IFAexploitsthekeyarchitecturalfeatureofNDNrelyingonPITtorecordtraf?cstates,andthuscanbringinseverenegativeimpactiononNDN’sfuturedevelopment(e.g.,itcansigni?cantlydegradeusers’experienceonretrievingcon-tent).Therefore,howtocounterIFAdeservesthefullatten-tionofthispaper.Fortunately,NDNroutersarestatefulsinceeachofthemneedstokeepper-communicationstateinitsPIT(recordingalltheforwardedInterests),andthustheycanlearnmuchmoreinformationaboutthetraf?cgoingthroughthem.Inaddition,PITentrytimeoutsofferrela-tivelycheaptraf?caggregatedetection(Vyasetal.2006).AllofthesecanhelpNDNcounterIFA.TakingadvantageofthesefeaturesofNDN,thispaperproposesacountermeasurenamedCooperative-Filter,whichisbasedonfuzzylogicandacooperationmechanismbetweenrouterstocounterIFA(fuzzylogiccanmakeeasythesystemmodelingwith-outahardmathematicalmodeling,aswellasgiveasatis-factorysolutioninareasonableimprovementofuser’sexpe-rienceonretrievingcontent).Practically,Cooperative-FilterdetectsIFAineachrouterconsideringtwoparameters:PIToccupancyrate(POR)andPITexpirationrate(PER)asthe

123

K.Wangetal.

inputsforitsfuzzylogicmodule,whereproducesthedeci-sionaboutthenecessityofsendingcontrolmessages(e.g.,pushbackmessages),andmitigatesIFAonlyatedgerouterswheremaliciousInterestpacketsareoriginally?oodedintoNDNwiththehelpofcooperationbetweeninvolvedrouters,toreducethemaliciousInterestpacketsthatcanenterNDN.

Themaincontributionsofthispapercanbesummarizedasfollows:

1.TheCooperative-Filterisdesigned,whichdetectsIFAbasedonfuzzylogicineachrouterbutmitigatesitby?l-teringincomingmaliciousInterestpacketsonlyatedgeroutersofNDNwiththehelpofcooperationbetweenrouters,ratherthaneverysinglerouter.

2.Anin-depthevaluationstudyusingextensivesimulationsquanti?esthedamageeffectofIFAonNDN,underareal-istic,large-scalenetworktopology.

3.TheperformanceofCooperative-Filterisevaluatedindetail,viaextensivesimulationsusingthewell-knownndnSIM(Afanasyevetal.2012),underarealisticusersbehaviormodelofInternet(theratesofInterestpack-etsrequestingdifferentcontentitemsfollowingZipf–Mandelbrotdistribution(Caro?glioetal.2011a,b,c)inalarge-scalenetworktopology,andresultsshowthatCooperative-FiltercaneffectivelydegradethedamageeffectofIFAonNDN.Therestofthepaperisorganizedasfollows.Section2overviewstheNDNbackgroundandrelatedworks.Sec-tion3proposestheCooperative-Filter.Section4evalu-atesthedamageofIFAaswellastheeffectivenessoftheproposedCooperative-Filter.Finally,Sect.5concludesthispaper.

2Background

Inthissection,abriefintroductionaboutNDNisgivenat?rst,andthentherelatedworksoncounteringIFAarepresented.2.1NDN2.1.1NDNnames

InNDN,thepacketnameishierarchicallyconstructedbyvariable-lengthnamecomponents,whichgenerallyincludesapre?xaswellasseveralsuf?xes.Forexample,thenameforadocumentinouruniversityBJTUcanbepresentedas“/China/Beijing/BJTU/document1”,where“/China/Beijing/BJTU”isthepre?xwhile“document1”isthesuf?x.InIFA,attackerscaneasilygeneratelargeamountofmaliciousInter-estpacketsbyspoo?ngtheirnames.Forexample,attackers

Cooperative-Filter:CounteringIFAinNDN

namespace(e.g.,“/China/Beijing/BJTU/xxxx”isthespoofedname,where“/China/Beijing/BJTU”isanexistentpre?xbut“xxxx”istheforgedsuf?x,asshowninFig.1).

2.1.2NDNpacketforwarding

CommunicationinNDNisthepullmodel(thatis,itisdrivenbytheconsumersofdata):aconsumerasksforcontentbysendinganInterestpacketthatcarriesthenameofthedesiredData,andDatapacketisdeliveredtoresponsetoconsumersonlyuponanexplicitInterestpacket.

UponanInterestpacket,anyintermediateNDNrouterchecksitsCStoseeifthereistherequestedcontent(thecor-respondingDatapacket)cachedthere.Ifso,itcanreturnwithacorrespondingDatapacket.Otherwise,therouterwouldlookupitsPITtocheckwhetherthereisalreadyaPITentryforthesameInterestpacketexisting.Ifso,thenewinter-facewherethisInterestcomesinisaddedintothematchingPITentrydescribedabove,buttheInterestisthendroppedwithoutforwarding.Otherwise,theInterestpacketwouldbeforwardedupstreambasedonFIBofthisNDNrouteraswellasrecordedasanewPITentry.

OnceaDatapacketreturns,thePIToftherouterischeckedtoseeiftheDatapackethasbeenrequestedbefore.IfthenameoftheDatapacketmatchesnoentryinPIT,theDatapacketisdroppedwithoutforwarding.Otherwise,theDatapacketisforwardedfromthecor-respondinginterfacerecordedinthematchingPITentry,andthenthecorrespondingentryisdeleted.Afterthat,acopyoftheDatapacketiscachedintheCSbasedonsomecachingreplacementpolicytosatisfypotentialfutureInterests.Inaddition,iftherearenoDatapacketreturnstosatisfythependingInterestinPIT,thecorrespond-ingPITentrywouldnotbeerasedfromthisrouteruntilexpired.

Asdescribedabove,PITplaysaveryimportantroleinbothInterestandDatapacketforwardingprocess,anditbringsinextramemoryresourceconsumptionforeachNDNrouterthanthetraditionalIP-basedrouterforpacketforward-ing.IFAtakesadvantageofPIT,whichisthefundamentalfeatureofNDN,toharmNDN.Asaresult,whetherIFAcanbeeffectivelymitigatediscriticaltoNDN’sfuture.

1805

2.2IFAmodel

Tobringinhugedamage,the?oodedmaliciousInterestpack-etsfromIFAshouldberoutedtowardstothevictim(e.g.,dataproducer)ascloseaspossible(Afanasyevetal.(2013)).ThiscanbeachievedwhenallthemaliciousInterestpacketsarewiththesamepre?x(e.g.,“/China/Beijing/BJTU”)butwithnonexistent/forgedsuf?x(e.g.,arandomstringsuchas“xxxx”),whichmakesthesemaliciousInterestpacketstoreachthevictimwithoutbeingsatis?edbycachesofinter-mediaterouters,sincetherequestedDatapacketsdonotexistthroughoutNDN.

ThispaperexclusivelyfocusesonthisparticularIFA(thatis,IFAattackersdotheirbesttoattackacertainnamespace/pre?xby?oodingfakeInterestpackets)becauseitcanbeeasytolaunchandbringinseveredamageonNDN(Afanasyevetal.2013).2.3Relatedwork

SinceNDNisproposedbyJacobsonetal.(2009),severalproposalshavefocusedonIFAandattemptedtodegradeitsdamageeffect.TheworksinTobiasetal.(2010)andGastietal.(2012)summarizetheIFAinNDN,whiletheauthorsinWahlischetal.(2013)mainlyanalyzedata-drivenstates(e.g.,bothcontentpublicationsandsubscriptionscanintroduceroutingorforwardingstatesatthenetworklayer)candegradethestabilityandsecurityofNDN.However,noneofthemdesignanycountermeasureforIFA(thatis,theyleaveitasanopenproblemandthedesignspeci?csforcounteringIFAremaintobe?lledin).

Furthermore,inWidjaja(2012),I.Widjajaproposesa?ex-ibleresourcemanagement(RM)systemforNDN.AlthoughRMmaypreventIFA,itchangesthebasicarchitectureofNDNrouterbydeletingPITandthenmixingthecachingofInterestsintoCS,whichincreasesthecomplexitytoindexeachdistinctInterestforinterfaceperformanceevaluationorguidingInterestforwardingwithineachrouter(Yietal.2013).Moreover,RMmainlyaimsathowtomakeintelli-gentdecisionsonstoringcontentobjects,ratherthanhowtosuppresstheincomingmaliciousInterestswithineachNDNrouter.

ThemechanismsinthelatestresearchofDaietal.(2013)andAfanasyevetal.(2013)focusonthesametopiconcoun-teringIFA,butdifferinthespeci?cs.TheauthorsinDaietal.(2013)proposethe“Interesttraceback”tocounterIFAbyspoo?ngcorrespondingDatapacketstosatisfythepend-ingfakeInterestsrecordedinPIT,andthentoblockmali-ciousInterestsattheedgerouterswheretheycomein,whichcande-stressthememoryresourceforPITineachinvolvedNDNrouter.However,“Interesttraceback”detectsIFAbysimplymonitoringthePITusage,whichcouldbringinrela-tivelyhigherfalsepositivewhenevertherecomesshort-term

123

1806networkchurns.Inaddition,theauthorsinAfanasyevetal.(2013)designthreedifferentIFAcountermeasures(Tokenbucketwithper-interfacefairness,satisfaction-basedInter-estacceptanceandsatisfaction-basedpushback)withvaryingdegreesofimplementationcomplexityandeffectiveness,byextendingthePITtosupport?aggingofIntereststhatcan-notbeimmediatelyforwardedandimplementinghierarchi-calqueuesforeachinterfaceofNDNrouter.Infact,allthethreemechanismsproposedatAfanasyevetal.(2013)mon-itoreachInterestpacketatthegranularityofper-interfaceineachrouter(withoutdistinguishingdifferentpre?xesofInterestpackets),whichmakessomelegitimatebutunfortu-nateInterestpacketsarerate-limitedaswell,iftheycomeintotheNDNrouterfromthesameinterfaceasmaliciousInterestpackets(eventheyarewithdifferentpre?xesratherthanthemaliciousone).

Inthispaper,theCooperative-Filterisproposed,whichembedsfuzzylogic-baseddetectionandintroducescooper-ativemechanismbetweenrouterstomitigateIFAata?nergranularity(e.g.,per-pre?x-per-interface).

3Proposedcountermeasure:Cooperative-FilterInNDN,Interestpacketisroutedbasedonthepre?xofcon-tentnamemeanwhiletemporarilycachedinPIT,whichcon-sumesthememoryresourceofeachintermediaterouterandthusgivesachanceforattackerstolaunchIFAbyexploitingPIT.Inthissection,ourIFAcountermeasureCooperative-Filterisdesignedindetail,whichestimatesthepossibilityofIFAbasedonfuzzylogic,andmitigatesitwiththehelpofcooperationbetweenrouters.

Cooperative-FilterisanIFA-counteringarchitectureimple-mentedinNDN,whichcanbeconsideredasasetofalgo-rithmsthatrunonrouters,andhaslowdegreeofimplemen-tationcomplexity.ItsgoalistoidentifyIFAaswellastomitigateitsdamageeffect.ThemainideaofCooperative-Filteris“detectingIFAeverywhere,butmitigatingitatthesource”,where“everywhere”meanseveryrouterinNDNwhile“source”meanseveryedgerouterthroughwhichcon-sumerscanaccessintoNDN.Thatis,thedetectionmecha-nismofCooperative-FilterisenabledateachrouterofNDNwhileitsmitigationmechanismisonlyenabledattheedgerouters.Thisisbecausetheroutersupstreamcanaggregatemoretraf?cthantheedgerouters,whichmakesthemthebettermonitoringpointtodetectanyattacks.Meanwhile,theedgeroutersdirectlyconnectwithexplicitconsumers,whichmakesittobemoreef?cientto?ltermaliciousInter-estpacketsthere.Tosumup,Cooperative-Filtercombineswidespreaddetectionandlocalizedmitigation,withthelat-terbeingascloseaspossibletotheattackingsource.

Particularly,Cooperative-Filterintegratesafuzzylogic-baseddetectionmechanism(DM)andamitigationmecha-

123

K.Wangetal.

nism(MM)basedoncooperationbetweenrouters.InDM,PIToccupancyrate(POR)andPITexpirationrate(PER)aremonitoredperiodically.PORrepresentstheratioofthenum-beroftemporalPITentriesagainstthemaximumPITentriesinrealtime,http://wendang.chazidian.comingthesetwoparameters(PORandPER)asinput,DMadjudgeswhetherthereisIFAexistingbasedonfuzzylogic.WheneverIFAisdetectedinarouter,MMisenabledandapushbackmessageisgeneratedtonotifyotherinvolvedrouters,bringincooperativemitigationonIFAtoreducethenumberofmaliciousInterestpacketsthatcanenterNDN.

3.1DM:IFAdetectionusingfuzzylogic

Fuzzylogic(Zadeh1965)wasproposedtodealwithsub-jectiveorimpreciseinformation,openingmanypossibilitiestosolveproblemsthatclassicalbooleanlogicisunabletoachieve.Thebasisforfuzzylogic(linguisticvalue/naturallanguage)isthebasisforhumancommunication(itcanassignintermediatevaluesbetweentrueandfalse),whichmakesiteasytouse.

NDNroutercankeepthestatisticsforongoingcommu-nications.Thus,PORandPERineachNDNroutercanbeeasilyobtainedbyDMofCooperative-Filter.InCooperative-Filter,thefuzzi?cationforPOR,PERandoutputofDMarerealizedusingfuzzylogic.Thatis,theaccuratevaluesforthesevariablesshouldbemappedintolinguisticvalues.Inthispaper,thetwolinguisticvaluesforPOR(orPER)aresettobeHIGHandNORMAL,whilethelinguisticvaluesforoutputofDMareIFAorNORMAL(whichmeansthereisnoIFAexisting).ThemappingofnumericalinputparametersandoutputofDMforfuzzysetsisrealizedusingmembershipfunctions.Respectively,themembershipfunctionforPOR,PERandoutputofDMareshowninFig.2a-c.ThefuzzycontrollerinferencerulesinthispaperareshowninTable1.Basedontheserules,theDMofCooperative-FiltergetsthePORandPERineachrouterasinput,andgivesthesecurestatusofthisrouter(e.g.,IFAorNORMAL)asoutput.TheworkingprocessofDMineachNDNrouterisdescribedasfollowing:

Step1:DMperiodicallymonitorsPORbycomparingthereal-timePITsizeandthemaximumPITvalue,meanwhileevaluatesPERbycomparingtheinstantaneousnumberoftheexpiredPITentriesandthetotalnumberofpendingPITentries;

Step2:Thereal-timePORandPERvaluesaremappedtofuzzysetsbasedontheircorrespondingmembershipfunc-tions(showninFig.2,takingPORforexample,ifPORequals0.9,thenPORcanbeidenti?edasbelongingtoNORMALby25%meanwhilebelongingtoHIGHby75%);

Cooperative-Filter:CounteringIFAinNDN

Fig.2Membershipfunctionsforinputandoutputthatareusedinfuzzylogic

Table1FuzzyinferencerulesPORPEROutputHIGHNORMALIFANORMALHIGHIFAHIGHHIGHIFANORMAL

NORMAL

NORMAL

Step3:ThefuzzyinferencerulesinTable1areapplied,toresultinafuzzysetoutput;

Step4:Thefuzzysetoutputistranslatedintoaquantitativevalue,whichiscalledasdefuzzi?cation,basedonthepopularmethod—centroidtechniquethatisshowninEq.(1).

??b

y=x=aμA(x)x,(1)x=aμA(x)whereyrepresentsthecenterofgravityoffuzzysetA

betweenaandb,andμA(x)representsthedegreeofxbelongingtofuzzysetA.

Forexample,asshowninFig.3,ifPORequals0.85andPERequals0.56,theoutputofthefuzzylogicwouldbe

0.691.

1807

Fig.3Examplefortheoutoffuzzy

logic

Fig.4Relationshipbetweenoutputandinputoffuzzylogic

Infact,basedontheFig.2,Table1andEq.(1),therela-tionshipbetweentheoutputofthefuzzylogicembeddedinDMandthePORaswellasPERcanbeshowninFig.4.Step5:WhenevertheoutputvalueofDMexceedstheprede?nedthreshold(e.g.,thethresholdfortheoutputofDMhasbeende?nedas0.6),IFAisidenti?edandanIFA-alertmessageissenttotheMMoftheproposedCooperative-Filter.

Afterthese?vesteps,DMis?nished.

InCooperative-Filter,DMonlyneedsthenaturalinforma-tionofPITrecordedineachNDNrouter,whichcanachievesmallconsumptiononeachrouterandthusavoidexception-allyrestrictiveinforwardingInterestpacketswhenIFAdoesnotexist.

3.2MM:IFAmitigationbasedoncooperationbetween

routersIntheIFAmodel(Sect.2.2)studiedinthispaper,allthemaliciousInterestpacketsarerequestingcorrespondingDatapacketswiththesamepre?xtoaggregateenoughamountofmalicioustraf?ctovictim.Asaresult,thepre?xwhichhas

123