Despite the highly secure content sharing and the optimized forwarding mechanism, the content delivery in a Named Data Network (NDN) still suffers from numerous vulnerabilities that can be exploited to reduce the efficiency of such architecture. Malicious attacks in NDN have become more sophisticated and the foremost challenge is to identify unknown and obfuscated malware, as the malware authors use different evasion techniques for information concealing to prevent detection by an Intrusion Detection System (IDS). For the most part, NDN faces immense negative impacts from attacks such as Cache Pollution Attacks (CPA), Cache Privacy Attacks, Cache Poisoning Attacks, and Interest Flooding Attacks (IFA), that target different security components, including availability, integrity, and confidentiality. This poses a critical challenge to the design of IDS in NDN. This paper provides the latest taxonomy, together with a review of the significant research works on IDSs up to the present time, and a classification of the proposed systems according to the taxonomy. It provides a structured and comprehensive overview of the existing IDSs so that a researcher can create an even better mechanism for the previously mentioned attacks. This paper discusses the limits of the techniques applied to design IDSs with recent findings that can be further exploited in order to optimize those detection and mitigation mechanisms.

/pdf/a-survey-on-security-attacks-and-intrusion-detection-3n2cqhrw.pdf

A Survey on Security Attacks and Intrusion Detection Mechanisms in Named Data Networking

Vehicular Content Centric Network (VCCN) has been proposed to address the issues of user mobility and sporadic connectivity in Vehicular Ad hoc Network (VANET). The in-network caching of VCCN can indeed improve the performance of content distribution in terms of cache hit and delivery latency by making each node store frequently accessed data. However, data caching unfortunately suffers from Cache Pollution Attack (CPA) that sends out fabricated requests to pollute the data cache. To prevent the degradation of network performance caused by such an attack, we propose a detection and defense scheme for CPA by adopting game theory. We model the attack scenario into a non-cooperative game model. First, we prove the non-existence of pure strategy Nash Equilibrium (NE) in the attacker and defender game, and propose a normal form game model with complete information and an extensive Bayesian form game model with incomplete information. Under the guidance of NE, we propose a punishment strategy to prevent the conspiracy attack and make the attackers behave normally. Moreover, we propose a cooperative detection scheme to give the Road Side Unit (RSU) the final decision on CPA based on the direct and indirect suspicious lists which are generated by each node according to the observed traffic pattern. Simulation evaluations demonstrate that our scheme outperforms state-of-the-art schemes in terms of cache hit, detecting ratio, and cache accuracy for detecting and defending CPA. 

Exploiting Non-Cooperative Game Against Cache Pollution Attack in Vehicular Content Centric Network

In Named Data Networking (NDN), Collusive Interest Flooding Attacks (CIFA) is a new type of Distributed Denial of Service (DDoS) attacks, which can effectively affect the performance of NDN by sending malicious Interests intermittently. Since the concealment of CIFA is strong, the existing detection methods for Interest Flooding Attacks (IFA) are difficult to find the malicious Interests in the NDN network. However, the subsequent attack strength of CIFA is weaker than that of IFA, resulting in the attack range of CIFA is much smaller than that of IFA in large network topologies. In order to launch the most serious attack with the least cost, the attack model of CIFA has been improved by our previous work, namely Improved Collusive Interest Flooding Attacks (I-CIFA). To better take the countermeasures against I-CIFA, this paper studies the adverse effects of I-CIFA in NDN and proposes a detection mechanism for I-CIFA. Foremost, we extract the corresponding network traffic and analyze the impact of I-CIFA on malicious routing nodes in different locations of the network. Furthermore, the detection mechanism based on BO-GBM fusion algorithm is proposed to detect I-CIFA through classifying the network traffic. Finally, several specific performance metrics are adopted to evaluate the practicability of BO-GBM fusion algorithm in detecting I-CIFA. The results show that BO-GBM fusion algorithm has better detection performance than other existing detection schemes, with the detection rate of 98.69%, false alarm rate of 1.36% and missing alarm rate of 1.43%. 

Detection of Improved Collusive Interest Flooding Attacks Using BO-GBM Fusion Algorithm in NDN

Named data networking (NDN) presents a huge opportunity to tackle some of the unsolved issues of IP‐based vehicular ad hoc networks (VANET). The core characteristics of NDN such as the name‐based routing, in‐network caching, and built‐in data security provide better management of VANET proprieties (e.g., the high mobility, link intermittency, and dynamic topology). This study aims at providing a clear view of the state‐of‐the‐art on the developments in place, in order to leverage the characteristics of NDN in VANET. We resort to a systematic literature review (SLR) to perform a reproducible study, gathering the proposed solutions and summarizing the main open challenges on implementing NDN‐based VANET. There exist several related studies, but they are more focused on other topics such as forwarding. This work specifically restricts the focus on VANET improvements by NDN‐based routing (not forwarding), caching, and security. The surveyed solution herein presented is performed between 2010 and 2021. The results show that proposals on the selected topics for NDN‐based VANET are recent (mainly from 2016 to 2021). Among them, caching is the most investigated topic. Finally, the main findings and the possible roadmaps for further development are highlighted.

https://onlinelibrary.wiley.com/doi/pdfdirect/10.1002/dac.5348

On the realization of VANET using named data networking: On improvement of VANET using NDN‐based routing, caching, and security

The performance of named data networking (NDN) depends on the caching efficiency of routers. Cache pollution attack (CPA) refers to colonization of unpopular contents in the content store (CS) of an NDN router, which leads to declined quality of service (QoS) in NDN. CPA has very few solutions proposed for its mitigation. Most of these solutions are based on the statistics of the router itself. However, an attacker can influence these statistics by requesting unpopular contents repeatedly. This article proposes a new parameter for the detection of CPA, which is based on the number of distinct users requesting interest packets for a content over a period of time. The local popularity of the attackers’ content does not affect the proposed approach. The results show that the proposed approach consumes less storage, reduces processing time, and more effectively mitigates the CPA, as compared to the other existing approaches. Compared with the previous approaches, the proposed approach exhibits an improvement of approximately 28.14% to 36.80%. 

IBPC: An Approach for Mitigation of Cache Pollution Attack in NDN using Interface-Based Popularity

The information-centric networking, which aims to solve the demand for distributing a large amount of content on the Internet, has proved to be a promising example for various network solutions, such as the Vehicular ad-hoc network (VANET). However, some problems are introduced when the named data networking is combined with V-NDN, such as the cache pollution. In order to solve the cache pollution attack, we propose a mechanism based on cache partition, which divides the cache of nodes into two parts and stores the content of different popularity respectively. We monitor the interest packets received by each node and get the corresponding popularity of each content. According to the popularity of the content, the content is stored in the corresponding cache. In addition, when the popularity of the content changes, we add the name of the content to the monitoring list to determine whether it is an attack content. This paper simulates the cache partition mechanism under different request frequencies and different forwarding strategies. The experimental results show that the average hit rate of node cache can be increased by 14% and the user request delay can be reduced by 30% when the node is attacked. At the same time, the number of Interest packets requested by normal users in the whole network has also been greatly reduced, which greatly reduces the traffic within the network. Experiments show that the cache partition mechanism can effectively resist the attack of cache pollution.

Cache Pollution Prevention Mechanism Based on Cache Partition in V-NDN

At present, the Internet is facing technical challenges in terms of dynamic, security, and scalability, and its development speed has been difficult to adapt to the explosive expansion of the global network scale. Because of its excellent characteristics, named data networking has been widely concerned by people, and has become the representative architecture of the future network. However, because of the characteristics of stateful forwarding, a new attack method, interest flooding attack, is introduced. The attacker makes a large number of requests to send malicious requests, thus exhausting the PIT table resources in the intermediate router. The interest packet is not cleared until it is out of date, so normal requests cannot be processed.To solve the above problems, we propose a defense scheme of interest flooding attack based on deep reinforcement learning. The agent is trained by collecting the relevant data of some routing nodes. Appropriate action space is designed to enable agents to take different defense measures according to different network states to achieve the purpose of defending IFA. Finally, the PIT entry is introduced into the reward function to evaluate the actions made by the agent. Finally, we compare the number of received packets, the number of retransmissions of interest packets, and the average request delay of users, and we find that the proposed mechanism can better resist the flooding attacks of interest packets.

Defense Mechanism of Interest Flooding Attack Based on Deep Reinforcement Learning

Information-centric networking (ICN) has played an increasingly important role in the next generation network design. However, to make better use of request-response communication mode in the ICN network, revoke user privileges more efficiently and protect user privacy more safely, an effective access control mechanism is needed. In this paper, we propose IBSS (identity-based secret sharing), which achieves efficient content distribution by using improved Shamir's secret sharing method. At the same time, collusion attacks are avoided by associating polynomials' degree with the number of users. When authenticating user identity and transmitting content, IBE and IBS are introduced to achieve more efficient and secure identity encryption. From the experimental results, the scheme only introduces an acceptable delay in file retrieval, and it can request follow-up content very efficiently.

Identity-based Secret Sharing Access Control Framework for Information-Centric Networking

Named data networking (NDN) has been invented for a decade and has found lots of potential applications. It has also been extensively researched and regarded as one of the most promising architectures of the future Internet. However, at the same time, more and more work noticed its deficiency in time-sensitive applications or under complex scenarios such as vehicular ad-hoc networks (VANET), mainly due to its request-response communication model and binding of Interest and Data path. To address that, in this paper, an asymmetric framework, called aNDN, is proposed to evolve the architecture of NDN, which features decoupling the forwarding of Interest and Data packets as well as supporting both PULL and PUSH models. Furthermore, three basic use cases of aNDN in VANET were conducted, demonstrating its advantages in data transfer efficiency. More importantly, this work first calls for substantial evolution of NDN to fulfill much broader requirements from current and future emerging applications.

Lianglang Deng

Papers

Cache Pollution Prevention Mechanism Based on Cache Partition in V-NDN

Defense Mechanism of Interest Flooding Attack Based on Deep Reinforcement Learning

Identity-based Secret Sharing Access Control Framework for Information-Centric Networking

Asymmetric Framework Evolution of Named Data Networking and Use Cases in VANET