Linkbait: Active Link Obfuscation to Thwart Link-flooding attacks
Qian Wang, Feng Xiao, Man Zhou, Zhibo Wang, Qi Lecky Li, Zhetao Li · arXiv (Cornell University) · 2017
The DDoS attack is a serious threat to Internet of Things (IoT). As a a new class of DDoS attack, Link-flooding attack (LFA) disrupts connectivity between legitimate hosts and target servers (i.e., victims) by flooding only a small number of links. Several mechanisms have been proposed to mitigate the sophisticated attack. However, they can only reactively mitigate LFA after target links have been flooded by the adversaries. In this paper, we propose an active LFA mitigation mechanism, called Linkbait, that is a proactive and preventive defense to throttle LFA. The fact behind Linkbait is that adversaries rely on the set of key links impacting the network connectivity (i.e., linkmap) to identify target links that ensure network connectivity of victims. Linkbait mitigates the attacks by interfering with linkmap discovery and providing a fake linkmap to adversaries. Inspired by moving target defense (MTD), we propose a link obfuscation algorithm in Linkbait that selectively reroutes probing flows to hide target links from adversaries and mislead them to identify bait links as target links. By providing the faked linkmap to adversaries, Linkbait can actively mitigate LFA even without identifying bots while not affecting flows from legitimate hosts. To block attack traffic and further reduce the impact in networks, we propose a bot detection algorithm that extracts unique traffic patterns of LFA and leverages support vector machine (SVM) to identify attack traffic. We evaluate the feasibility of deploying Linkbait in real Internet, and evaluate its performance by using both real-world experiments and large-scale simulations. The experimental results demonstrate the effectiveness of Linkbait.