LogDos: A Novel Logging-based DDoS Prevention Mechanism in Path Identifier-Based Information Centric Networks

TL;DR

LogDos is a new logging-based defense mechanism for ICNs that effectively filters DDoS attack traffic using Bloom filters, achieving over 99.98% attack mitigation with manageable storage overhead.

Contribution

It introduces LogDos, a novel DDoS prevention approach in path-identifier based ICNs utilizing GET message logging and Bloom filters for efficient attack filtering.

Findings

Filters over 99.98% of attack traffic in simulations

Employs Bloom filters for scalable logging

Offers three versions with varying storage overhead

Abstract

Information Centric Networks (ICNs) have emerged in recent years as a new networking paradigm for the next-generation Internet. The primary goal of these networks is to provide effective mechanisms for content distribution and retrieval based on in-network content caching. The design of different ICN architectures addressed many of the security issues found in the traditional Internet. Therefore, allowing for a secure, reliable, and scalable communication over the Internet. However, recent research studies showed that these architectures are vulnerable to different types of DDoS attacks. In this paper, we propose a defense mechanism against distributed denial of service attacks (DDoS) in path-identifier based information centric networks. The proposed mechanism, called LogDos, performs GET Message logging based filtering and employs Bloom filter based logging to store incoming GET messages such that corresponding content messages are verified, while filtering packets originating from malicious hosts. We develop three versions of LogDos with varying levels of storage overhead at LogDos-enabled router. Extensive simulation experiments show that LogDos is very effective against DDoS attacks as it can filter more than 99.98 % of attack traffic in different attack scenarios while incurring acceptable storage overhead.