Analyzing the Benefits of Optical Topology Programming for Mitigating Link-Flood DDoS Attacks
Link-flood attacks (LFAs) overwhelm bandwidth on links in a network using traffic from many sources, which is indistinguishable from benign traffic. Unfortunately, traditional DDoS defenses are incapable of stopping such attacks and recently proposed software-defined solutions are ineffective. In th...
Saved in:
| Published in: | IEEE transactions on dependable and secure computing Vol. 22; no. 1; pp. 146 - 163 |
|---|---|
| Main Authors: | , , , |
| Format: | Journal Article |
| Language: | English |
| Published: |
Washington
IEEE
01.01.2025
IEEE Computer Society |
| Subjects: | |
| ISSN: | 1545-5971, 1941-0018 |
| Online Access: | Get full text |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Abstract | Link-flood attacks (LFAs) overwhelm bandwidth on links in a network using traffic from many sources, which is indistinguishable from benign traffic. Unfortunately, traditional DDoS defenses are incapable of stopping such attacks and recently proposed software-defined solutions are ineffective. In this work, we observe a new opportunity for mitigating LFAs using optical networking advances. In essence, we envision new capabilities for topology programming , to scale capacity on-demand to avoid congestion and add new links to the network to create new paths for traffic during LFA incidents. Realizing these benefits of optical topology programming raises unique challenges; the search space for candidate topology configurations is very large and joint optimization of topology and routing is NP-hard. We present ONSET-a framework that tackles these challenges to lay a practical foundation for topology programming-based defenses against LFAs. We show that ONSET complements existing programmable network defenses and amplifies their benefits. We perform a what-if style analysis of ONSET by simulating a wide-ranging set of attacks, including terabit-scale attacks against every single link, on five networks with two different routing capabilities and observe that ONSET provides the means to mitigate congestion loss in more than 90% of the hundreds of diverse attack scenarios considered. |
|---|---|
| AbstractList | Link-flood attacks (LFAs) overwhelm bandwidth on links in a network using traffic from many sources, which is indistinguishable from benign traffic. Unfortunately, traditional DDoS defenses are incapable of stopping such attacks and recently proposed software-defined solutions are ineffective. In this work, we observe a new opportunity for mitigating LFAs using optical networking advances. In essence, we envision new capabilities for topology programming , to scale capacity on-demand to avoid congestion and add new links to the network to create new paths for traffic during LFA incidents. Realizing these benefits of optical topology programming raises unique challenges; the search space for candidate topology configurations is very large and joint optimization of topology and routing is NP-hard. We present ONSET-a framework that tackles these challenges to lay a practical foundation for topology programming-based defenses against LFAs. We show that ONSET complements existing programmable network defenses and amplifies their benefits. We perform a what-if style analysis of ONSET by simulating a wide-ranging set of attacks, including terabit-scale attacks against every single link, on five networks with two different routing capabilities and observe that ONSET provides the means to mitigate congestion loss in more than 90% of the hundreds of diverse attack scenarios considered. |
| Author | Sekar, Vyas Liu, Zaoxing Durairajan, Ramakrishnan Nance-Hall, Matthew |
| Author_xml | – sequence: 1 givenname: Matthew orcidid: 0000-0002-0802-2920 surname: Nance-Hall fullname: Nance-Hall, Matthew email: mhall@cs.uoregon.edu organization: University of Oregon, Eugene, OR, USA – sequence: 2 givenname: Zaoxing orcidid: 0000-0002-9119-1679 surname: Liu fullname: Liu, Zaoxing organization: University of Maryland, College Park, MD, USA – sequence: 3 givenname: Vyas surname: Sekar fullname: Sekar, Vyas organization: Carnegie Mellon University, Pittsburgh, PA, USA – sequence: 4 givenname: Ramakrishnan orcidid: 0000-0003-2859-5598 surname: Durairajan fullname: Durairajan, Ramakrishnan organization: University of Oregon, Eugene, OR, USA |
| BookMark | eNp9kE1PAjEQhhuDiYj-ABMPTTwvttvvI4KoCQYT8Gg23aW7FpYttuWAv97dwMF48DQzyfPOZJ5L0GtcYwC4wWiIMVL3y8liPExRSoeEKIylPAN9rChOEMKy1_aMsoQpgS_AZQhr1JJS0T74GDW6PnzbpoLx08AH05jSxgBdCee7aAtdw6XbudpVB_jmXeX1dtvBpfPw1UZb6diNM9tskmnt3ApOJm4BRzHqYhOuwHmp62CuT3UA3qePy_FzMps_vYxHs6RIFY3JimnNeG5oio0mAgkhc1lgpGmuCaWKlUTkiJtUcLoigiojmRaizBk3SBpBBuDuuHfn3dfehJit3d63n4WMYMY5pSlJWwofqcK7ELwps523W-0PGUZZZzHrLGadxexksc2IP5nCxvZn10Svbf1v8vaYtMaYX5cYoopz8gONo4EG |
| CODEN | ITDSCM |
| CitedBy_id | crossref_primary_10_1016_j_cose_2024_103981 |
| Cites_doi | 10.1109/SDS.2017.7939138 10.1145/3405669.3405824 10.1145/2934872.2934911 10.1109/JSAC.2006.877138 10.1145/3544216.3544263 10.1109/MCOM.2010.5496878 10.1109/SURV.2013.031413.00127 10.1145/3473938.3474510 10.1016/j.jnca.2020.102803 10.1364/JOCN.8.000A45 10.1145/948109.948116 10.1117/12.2549080 10.1287/trsc.1050.0127 10.17487/rfc2827 10.1007/978-3-642-04444-1_3 10.1145/2534169.2486007 10.1109/SP.2018.00032 10.1145/2934872.2934904 10.1364/OFC.2018.Tu3H.2 10.1109/ACCESS.2020.3013998 10.1109/SFCS.1975.21 10.1145/3452296.3472921 10.1109/90.917075 10.1109/TSSC.1968.300136 10.1364/OFC.2021.F3B.1 10.1109/SP.2013.19 10.14722/ndss.2016.23147 10.1145/2534169.2486019 10.1145/3185467.3185498 10.1109/TIFS.2021.3075845 10.1145/3452296.3472895 10.1109/JSAC.2011.111002 10.1109/CICN.2012.149 10.1364/JOCN.11.000C94 |
| ContentType | Journal Article |
| Copyright | Copyright IEEE Computer Society 2025 |
| Copyright_xml | – notice: Copyright IEEE Computer Society 2025 |
| DBID | 97E RIA RIE AAYXX CITATION JQ2 |
| DOI | 10.1109/TDSC.2024.3391188 |
| DatabaseName | IEEE All-Society Periodicals Package (ASPP) 2005–Present IEEE All-Society Periodicals Package (ASPP) 1998–Present IEEE/IET Electronic Library CrossRef ProQuest Computer Science Collection |
| DatabaseTitle | CrossRef ProQuest Computer Science Collection |
| DatabaseTitleList | ProQuest Computer Science Collection |
| Database_xml | – sequence: 1 dbid: RIE name: IEEE/IET Electronic Library url: https://ieeexplore.ieee.org/ sourceTypes: Publisher |
| DeliveryMethod | fulltext_linktorsrc |
| Discipline | Computer Science |
| EISSN | 1941-0018 |
| EndPage | 163 |
| ExternalDocumentID | 10_1109_TDSC_2024_3391188 10504966 |
| Genre | orig-research |
| GrantInformation_xml | – fundername: National Science Foundation grantid: CNS-2212590; SaTC-2132651 funderid: 10.13039/100000001 – fundername: University of Oregon Doctoral Research Fellowship |
| GroupedDBID | .4S .DC 0R~ 29I 4.4 5GY 5VS 6IK 7WY 8FE 8FG 8FL 8R4 8R5 97E AAJGR AARMG AASAJ AAWTH ABAZT ABJCF ABQJQ ABUWG ABVLG ACGFO ACIWK AENEX AETIX AFKRA AGQYO AGSQL AHBIQ AIBXA AKJIK AKQYR ALMA_UNASSIGNED_HOLDINGS ARAPS ARCSS ATWAV AZQEC BEFXN BENPR BEZIV BFFAM BGLVJ BGNUA BKEBE BPEOZ BPHCQ CCPQU CS3 DU5 DWQXO EBS EDO EJD FRNLG GNUQQ HCIFZ HZ~ IEDLZ IFIPE IPLJI ITG ITH JAVBF K60 K6V K6~ K7- L6V LAI M0C M43 M7S O9- OCL P2P P62 PHGZM PHGZT PQBIZ PQBZA PQGLB PQQKQ PROAC PTHSS PUEGO Q2X RIA RIE RNI RNS RZB AAYXX AFFHD CITATION JQ2 |
| ID | FETCH-LOGICAL-c294t-d5aa56be421ea370778b8c10a4ba34495f37b06e2764d3749e85a77fb56e08e73 |
| IEDL.DBID | RIE |
| ISICitedReferencesCount | 3 |
| ISICitedReferencesURI | http://www.webofscience.com/api/gateway?GWVersion=2&SrcApp=Summon&SrcAuth=ProQuest&DestLinkType=CitingArticles&DestApp=WOS_CPL&KeyUT=001398650500047&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D |
| ISSN | 1545-5971 |
| IngestDate | Thu Sep 25 00:43:03 EDT 2025 Tue Nov 18 22:28:57 EST 2025 Sat Nov 29 03:48:47 EST 2025 Wed Aug 27 01:55:50 EDT 2025 |
| IsPeerReviewed | false |
| IsScholarly | true |
| Issue | 1 |
| Language | English |
| License | https://ieeexplore.ieee.org/Xplorehelp/downloads/license-information/IEEE.html https://doi.org/10.15223/policy-029 https://doi.org/10.15223/policy-037 |
| LinkModel | DirectLink |
| MergedId | FETCHMERGED-LOGICAL-c294t-d5aa56be421ea370778b8c10a4ba34495f37b06e2764d3749e85a77fb56e08e73 |
| Notes | ObjectType-Article-1 SourceType-Scholarly Journals-1 ObjectType-Feature-2 content type line 14 |
| ORCID | 0000-0002-9119-1679 0000-0003-2859-5598 0000-0002-0802-2920 |
| PQID | 3156644232 |
| PQPubID | 27603 |
| PageCount | 18 |
| ParticipantIDs | crossref_primary_10_1109_TDSC_2024_3391188 ieee_primary_10504966 proquest_journals_3156644232 crossref_citationtrail_10_1109_TDSC_2024_3391188 |
| PublicationCentury | 2000 |
| PublicationDate | 2025-Jan.-Feb. 2025-1-00 20250101 |
| PublicationDateYYYYMMDD | 2025-01-01 |
| PublicationDate_xml | – month: 01 year: 2025 text: 2025-Jan.-Feb. |
| PublicationDecade | 2020 |
| PublicationPlace | Washington |
| PublicationPlace_xml | – name: Washington |
| PublicationTitle | IEEE transactions on dependable and secure computing |
| PublicationTitleAbbrev | TDSC |
| PublicationYear | 2025 |
| Publisher | IEEE IEEE Computer Society |
| Publisher_xml | – name: IEEE – name: IEEE Computer Society |
| References | ref57 ref12 Yoachimik (ref7) 2022 ref15 ref59 ref53 ref52 ref55 ref10 Kang (ref58) 2016 Ferguson (ref38) 2021 ref17 ref16 Li (ref23) 2007 Durairajan (ref26) 2018 Heorhiadi (ref54) 2020 (ref9) 2019 Liu (ref34) 2021 ref51 ref50 Nance-Hall (ref43) 2021; 41 Russell (ref5) 2018 ref46 ref45 (ref42) 2023 ref48 ref47 ref41 ref44 Nance-Hall (ref27) 2020 ref49 Toh (ref6) 2021 Ferguson (ref14) 2000 (ref1) 2022 ref40 Fayaz (ref19) 2015 (ref8) 2019 Warburton (ref2) 2022 ref35 ref37 ref36 ref31 ref30 ref33 ref32 ref39 (ref11) 2019 ref24 ref25 ref63 ref22 ref66 ref65 (ref3) 2021 Meier (ref62) 2018 ref28 Stone (ref18) 2000 ref29 Filer (ref56) 2019; 11 Yoachimik (ref4) 2022 Xing (ref20) 2021 Zhang (ref21) 2020 ref60 Kim (ref64) 2022 Baker (ref13) 2004; 3704 ref61 |
| References_xml | – ident: ref53 doi: 10.1109/SDS.2017.7939138 – volume-title: Proc. ACM SIGCOMM Workshop Opt. Syst. Des. year: 2020 ident: ref27 article-title: Bridging the optical-packet network chasm via secure enclaves – volume: 3704 year: 2004 ident: ref13 article-title: Ingress filtering for multihomed networks – year: 2022 ident: ref4 article-title: DDOS attack trends for 2022 Q2 – start-page: 1 volume-title: Proc. 27th Netw. Distrib. System Secur. Symp. year: 2020 ident: ref21 article-title: Poseidon: Mitigating volumetric DDOS attacks with programmable switches – ident: ref22 article-title: The history of optical and ethernet – ident: ref45 doi: 10.1145/3405669.3405824 – ident: ref25 doi: 10.1145/2934872.2934911 – year: 2018 ident: ref26 article-title: Greyfiber: A system for providing flexible access to wide-area connectivity – ident: ref16 doi: 10.1109/JSAC.2006.877138 – start-page: 1 volume-title: Proc. 9th USENIX Secur. Symp. year: 2000 ident: ref18 article-title: CenterTrack: An IP overlay network for tracking DoS floods – ident: ref35 doi: 10.1145/3544216.3544263 – ident: ref55 doi: 10.1109/MCOM.2010.5496878 – year: 2023 ident: ref42 article-title: Verizon optical wave service – year: 2022 ident: ref1 article-title: Network denial of service: Direct network flood – ident: ref61 doi: 10.1109/SURV.2013.031413.00127 – ident: ref28 doi: 10.1145/3473938.3474510 – ident: ref60 doi: 10.1016/j.jnca.2020.102803 – start-page: 1 volume-title: Proc. Annu. Netw. Distrib. Syst. Secur. Symp. year: 2022 ident: ref64 article-title: EqualNet: A secure and practical defense for long-term network topology obfuscation – start-page: 3865 volume-title: Proc. 30th USENIX Secur. Symp. year: 2021 ident: ref20 article-title: Ripple: A programmable, decentralized link-flooding defense against adaptive adversaries – year: 2022 ident: ref2 article-title: 2022 application protection report: DDOS attack trends – ident: ref40 doi: 10.1364/JOCN.8.000A45 – year: 2019 ident: ref8 article-title: Akamai security solutions – ident: ref15 doi: 10.1145/948109.948116 – year: 2021 ident: ref6 article-title: Azure DDoS protection—2021 Q3 and Q4 DDoS attack trends,” – year: 2021 ident: ref3 article-title: Issue 8: Findings from 2nd half 2021 – ident: ref46 doi: 10.1117/12.2549080 – ident: ref47 doi: 10.1287/trsc.1050.0127 – year: 2000 ident: ref14 article-title: Network ingress filtering: Defeating denial of service attacks which employ ip source address spoofing doi: 10.17487/rfc2827 – ident: ref31 doi: 10.1007/978-3-642-04444-1_3 – ident: ref24 doi: 10.1145/2534169.2486007 – ident: ref17 doi: 10.1109/SP.2018.00032 – ident: ref65 doi: 10.1145/2934872.2934904 – year: 2020 ident: ref54 article-title: TMgen – ident: ref41 doi: 10.1364/OFC.2018.Tu3H.2 – volume: 41 volume-title: Opt. Switching Netw. year: 2021 ident: ref43 article-title: A survey of reconfigurable optical networks – ident: ref59 doi: 10.1109/ACCESS.2020.3013998 – ident: ref50 doi: 10.1109/SFCS.1975.21 – ident: ref66 doi: 10.1145/3452296.3472921 – start-page: 3829 volume-title: Proc. 30th USENIX Secur. Symp. year: 2021 ident: ref34 article-title: Jaqen: A high-performance switch-native approach for detecting and mitigating volumetric DDOS attacks with programmable switches – year: 2022 ident: ref7 article-title: Cloudflare DDOS threat report for 2022 Q4 – ident: ref29 doi: 10.1109/90.917075 – ident: ref49 doi: 10.1109/TSSC.1968.300136 – start-page: 1 volume-title: Proc. Annu. Netw. Distrib. Syst. Secur. Symp. year: 2016 ident: ref58 article-title: SPIFFY: Inducing cost-detectability tradeoffs for persistent link-flooding attacks – ident: ref44 doi: 10.1364/OFC.2021.F3B.1 – ident: ref32 doi: 10.1109/SP.2013.19 – ident: ref33 doi: 10.14722/ndss.2016.23147 – ident: ref37 doi: 10.1145/2534169.2486019 – ident: ref57 doi: 10.1109/SP.2013.19 – ident: ref51 doi: 10.1145/3185467.3185498 – year: 2019 ident: ref11 article-title: Advanced DDOS attack protection – ident: ref63 doi: 10.1109/TIFS.2021.3075845 – ident: ref48 doi: 10.1145/3452296.3472895 – year: 2007 ident: ref23 article-title: Reconfigurable optical add-drop multiplexer – volume: 11 start-page: C94 issue: 10 volume-title: J. Opt. Commun. Netw. year: 2019 ident: ref56 article-title: Low-margin optical networking at cloud scale – start-page: 817 volume-title: Proc. 24th USENIX Secur. Symp. year: 2015 ident: ref19 article-title: Bohatei: Flexible and elastic DDoS defense – ident: ref36 doi: 10.1109/JSAC.2011.111002 – ident: ref12 doi: 10.1109/CICN.2012.149 – ident: ref39 doi: 10.1364/JOCN.11.000C94 – ident: ref52 article-title: Gurobi optimizer – year: 2019 ident: ref9 article-title: AWS shield: Managed DDOS protection – ident: ref10 article-title: Centurylink DDOS mitigation – start-page: 693 volume-title: Proc. 27th USENIX Secur. Symp. year: 2018 ident: ref62 article-title: NetHide: Secure and practical network topology obfuscation – start-page: 83 volume-title: Proc. USENIX Conf. Networked Syst. Des. Implementation year: 2021 ident: ref38 article-title: Orion: Google’s software-defined networking control plane – ident: ref30 doi: 10.1145/3405669.3405824 – year: 2018 ident: ref5 article-title: The world’s largest DDoS attack took github offline for fewer than 10 minutes |
| SSID | ssj0024894 |
| Score | 2.4011474 |
| Snippet | Link-flood attacks (LFAs) overwhelm bandwidth on links in a network using traffic from many sources, which is indistinguishable from benign traffic.... |
| SourceID | proquest crossref ieee |
| SourceType | Aggregation Database Enrichment Source Index Database Publisher |
| StartPage | 146 |
| SubjectTerms | Computer crime Computer simulation experiments Cybersecurity DDoS defense Network topologies Network topology Optical fiber communication Optical fiber networks optical networks Programming Routing Topology Topology optimization Traffic capacity Traffic congestion wide area networks |
| Title | Analyzing the Benefits of Optical Topology Programming for Mitigating Link-Flood DDoS Attacks |
| URI | https://ieeexplore.ieee.org/document/10504966 https://www.proquest.com/docview/3156644232 |
| Volume | 22 |
| WOSCitedRecordID | wos001398650500047&url=https%3A%2F%2Fcvtisr.summon.serialssolutions.com%2F%23%21%2Fsearch%3Fho%3Df%26include.ft.matches%3Dt%26l%3Dnull%26q%3D |
| hasFullText | 1 |
| inHoldings | 1 |
| isFullTextHit | |
| isPrint | |
| journalDatabaseRights | – providerCode: PRVIEE databaseName: IEEE/IET Electronic Library customDbUrl: eissn: 1941-0018 dateEnd: 99991231 omitProxy: false ssIdentifier: ssj0024894 issn: 1545-5971 databaseCode: RIE dateStart: 20040101 isFulltext: true titleUrlDefault: https://ieeexplore.ieee.org/ providerName: IEEE |
| link | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV3PS8MwFA5OPHjx58TplBw8CZ1Jk_alx7k5vKiDTdhFStq-wEA3cVXQv94k7ZwgCt5aSKD0y8t7X_Le-wg549oCjZAFrLDcRJqcBwkgBGGujZAmiXWhvdgE3N6qySQZ1sXqvhYGEX3yGXbco7_LL-b5qzsqsxYe2YA2jhukAQBVsdaqsZ7yqocuJAhslMzrK0zOkotxf9SzVDCUHSGscXuVlZUT8qoqP7Zi718G2__8sh2yVQeStFshv0vWcLZHtpciDbS22X3y4NuOfFgPRW2sRy_t3mam5YLODb179gfZdFwJJbzTYZWs9eQG22CW3kyrDhz21XHWYOCy3Gm_Px_Rblm66vwmuR9cjXvXQa2pEORhIsugiLSO4gxlyFELYAAqUzlnWmZaSMuWjICMxRhCLAsBMkEVaQCTRTEyhSAOyPpsPsNDQo3ICiyygkswkhvUisVh7gRjpLK0krcIW_7kNK8bjjvdi8fUEw-WpA6X1OGS1ri0yPnXlOeq28Zfg5sOiG8DKwxapL2EMq0NcpEKx1Olu5U--mXaMdkMnbavP15pk_Xy5RVPyEb-Vk4XL6d-rX0ChL7Qdg |
| linkProvider | IEEE |
| linkToHtml | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV3fS8MwED78Bfri_InTqXnwSagmTdq0j-ocijoHm-CLlLS9wEC3sXWC_vUmaaeCKPjWwgVKvl5y3yV3H8ARUwZolKlHc8NNhM6YF0uUnp8pzYWOQ5UrJzYh2-3o8THuVMXqrhYGEd3lMzyxj-4sPx9mU5sqMx4emIA2DOdhMRDCZ2W51ldrvcjpHtqgwDNxMqsOMRmNT3vN7oUhg7444dy4t9NZ-dqGnK7Kj8XY7TCt2j-_bQ1Wq1CSnJXYr8McDjagNpNpIJXXbsKTazzybvYoYqI9cm5WN90vJmSoyf3IpbJJr5RKeCOd8rrWizU24Sy565c9OMyrZa1ey95zJ83msEvOisLW52_BQ-uyd3HlVaoKXubHovDyQKkgTNHMHyouqZRRGmWMKpEqLgxf0lymNERfhiLnUsQYBUpKnQYh0ggl34aFwXCAO0A0T3PM05wJqQXTqCIa-pmVjBGRIZasDnQ2yUlWtRy3yhfPiaMeNE4sLonFJalwqcPx55BR2W_jL-MtC8Q3wxKDOjRmUCaVS04SbpmqsOfSu78MO4Tlq97dbXJ73b7ZgxXfKv26ZEsDForxFPdhKXst-pPxgfvvPgCHhdO9 |
| openUrl | ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Ajournal&rft.genre=article&rft.atitle=Analyzing+the+Benefits+of+Optical+Topology+Programming+for+Mitigating+Link-Flood+DDoS+Attacks&rft.jtitle=IEEE+transactions+on+dependable+and+secure+computing&rft.au=Nance-Hall%2C+Matthew&rft.au=Liu%2C+Zaoxing&rft.au=Sekar%2C+Vyas&rft.au=Durairajan%2C+Ramakrishnan&rft.date=2025-01-01&rft.issn=1545-5971&rft.eissn=1941-0018&rft.volume=22&rft.issue=1&rft.spage=146&rft.epage=163&rft_id=info:doi/10.1109%2FTDSC.2024.3391188&rft.externalDBID=n%2Fa&rft.externalDocID=10_1109_TDSC_2024_3391188 |
| thumbnail_l | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/lc.gif&issn=1545-5971&client=summon |
| thumbnail_m | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/mc.gif&issn=1545-5971&client=summon |
| thumbnail_s | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/sc.gif&issn=1545-5971&client=summon |