Towards mitigating Link Flooding Attack via incremental SDN deployment

Link flooding attack (LFA), as a new type of DDoS attack, can degrade or even cut off network connectivity of a target area. This attack employs legitimate, low-density flows to flood a group of selected links. Therefore, these malicious flows can hardly be distinguished by traditional schemes. In this paper, we propose a scheme called Woodpecker, which makes the LFA more difficult to take effect. First, we select M routers and upgrade them into SDN switches that can maximize the network connectivity. Second, we propose a proactive probe approach to quickly locate the congested links and judge whether LFA occurs. Finally, Woodpecker employs centralized traffic engineering based on the upgraded nodes, which can make the traffic balanced enough to eliminate the routing bottlenecks likely to be utilized by the adversary. We evaluate our scheme by comprehensive experiments. The results show that: 1) the bandwidth utilization of LFA-attacked links can be reduced by around 50%; 2) the average packet loss rate and jitter can be effectively mitigated under LFA attacks.