一种新的分布式链路洪泛攻击建模与缓解框架
A Novel Framework for Modeling and Mitigating Distributed Link Flooding Attacks
摘要：
分布式链路泛洪攻击是一种新的攻击类型，具有分割互联网大区域的潜力。它们的分布式特性使得检测和缓解非常困难。这项工作提出了一个新的框架，分析建模和最佳缓解这种攻击。检测被建模为关系代数的问题，代表潜在的攻击者（机器人）的潜在目标的关联。分析试图以最佳方式消除除恶意联想之外的所有联想。该框架是在在线流量工程（TE）的水平上实现的，这是自然触发的链接洪水事件。关键思想是不断重新路由流量，使任何良性源都不可能持续参与链路泛洪事件。因此，机器人被迫采取可疑的行为来保持有效性，从而暴露它们的存在。TE的负载平衡目标完全不受影响。各种拓扑结构上的广泛模拟验证了我们的分析结果。
英文摘要：
Distributed link-flooding attacks constitute a new class of attacks with the potential to segment large areas of the Internet. Their distributed nature makes detection and mitigation very hard. This work proposes a novel framework for the analytical modeling and optimal mitigation of such attacks. The detection is modeled as a problem of relational algebra, representing the association of potential attackers (bots) to potential targets. The analysis seeks to optimally dissolve all but the malevolent associations. The framework is implemented at the level of online Traffic Engineering (TE), which is naturally triggered on link-flooding events. The key idea is to continuously re-route traffic in a manner that makes persistent participation to link-flooding events highly improbable for any benign source. Thus, bots are forced to adopt a suspicious behavior to remain effective, revealing their presence. The load-balancing objective of TE is not affected at all. Extensive simulations on various topologies validate our analytical findings.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
