With the advancement of large-scale coordinated attacks, the adversary is shifting away from traditional distributed denial of service (DDoS) attacks against servers to sophisticated DDoS attacks against Internet infrastructures. Link flooding attacks (LFAs) are such powerful attacks against Internet links. Employing network measurement techniques, the defender could detect the link under attack. However, given the large number of Internet links, the defender can only monitor a subset of the links simultaneously, whereas any link might be attacked. Therefore, it remains challenging to practically deploy detection methods. This paper addresses this challenge from a game-theoretic perspective, and proposes a randomized approach (like security patrolling) to optimize LFA detection strategies. Specifically, we formulate the LFA detection problem as a Stackelberg security game, and design randomized detection strategies in consideration of the adversary's behavior, where best and quantal response models are leveraged to characterize the adversary's behavior. We employ a series of techniques to solve the nonlinear and nonconvex NP-hard optimization problems for finding the equilibrium. The experimental results demonstrate the necessity of handling LFAs from a game-theoretic perspective and the effectiveness of our solutions. We believe our study is a significant step forward in formally understanding LFA detection strategies.

中文翻译：

---

用于链路泛洪攻击检测的随机安全巡逻

随着大规模协同攻击的推进，攻击者正在从针对服务器的传统分布式拒绝服务 (DDoS) 攻击转向针对互联网基础设施的复杂 DDoS 攻击。链接泛洪攻击 (LFA) 是针对 Internet 链接的如此强大的攻击。使用网络测量技术，防御者可以检测受到攻击的链路。然而，由于互联网链接数量众多，防御者只能同时监控一部分链接，而任何链接都可能受到攻击。因此，实际部署检测方法仍然具有挑战性。本文从博弈论的角度解决了这一挑战，并提出了一种随机方法（如安全巡逻）来优化 LFA 检测策略。具体来说，我们将 LFA 检测问题表述为 Stackelberg 安全博弈，并考虑到对手的行为设计随机检测策略，其中利用最佳和量子响应模型来表征对手的行为。我们采用了一系列技术来解决非线性和非凸的 NP-hard 优化问题以找到平衡点。实验结果证明了从博弈论的角度处理 LFA 的必要性和我们解决方案的有效性。我们相信我们的研究是正式理解 LFA 检测策略的重要一步。我们采用了一系列技术来解决非线性和非凸的 NP-hard 优化问题以找到平衡点。实验结果证明了从博弈论的角度处理 LFA 的必要性和我们解决方案的有效性。我们相信我们的研究是正式理解 LFA 检测策略的重要一步。我们采用了一系列技术来解决非线性和非凸的 NP-hard 优化问题以找到平衡点。实验结果证明了从博弈论的角度处理 LFA 的必要性和我们解决方案的有效性。我们相信我们的研究是正式理解 LFA 检测策略的重要一步。