Link Flooding Attack (LFA) is a genre of Distributed Denial of Service (DDoS) attack. LFA can cut off a target area from the network, without directly attacking the target. The attacker chooses links which when cut off will disconnect the target area and instruct the bots to flood those links with small packets. Some of the existing solutions are suitable for specific routing methods like shortest path routing or need cooperation between Autonomous Systems (AS). To overcome certain hitches of existing solutions, we have proposed a novel mechanism named BALANCE. It detects and mitigates LFA via hybrid-Software-Defined Network (SDN). SDN splits the control and data plane using OpenFlow protocol. Hybrid SDN has both legacy and SDN nodes, with a controller in the control plane. We have used Service Based Hybrid SDN (SBHS), which is a type of hybrid-SDN. BALANCE begins with an algorithm that chooses nodes in an AS to be SBHS enabled in such a way that the controller can get statistics of all the links in the AS. Next, congestion detection and location algorithms are implemented in the controller to find the congested links. Finally, LFA bot detection and mitigation algorithms are implemented in the controller to mitigate LFA. BALANCE was evaluated in testbed and emulator. We compared the results with state-of-the-art solutions. BALANCE was able to detect LFA bots at a precision of 97.64% and had HTTP response time of 2 seconds during the LFA attack.

中文翻译：

---

BALANCE：通过混合 SDN 进行链路泛洪攻击检测和缓解

链路泛洪攻击 (LFA) 是分布式拒绝服务 (DDoS) 攻击的一种类型。LFA 可以从网络中切断目标区域，而不直接攻击目标。攻击者选择在切断时将断开目标区域的链接，并指示机器人用小数据包淹没这些链接。一些现有的解决方案适用于特定的路由方法，例如最短路径路由或需要自治系统（AS）之间的协作。为了克服现有解决方案的某些问题，我们提出了一种名为 BALANCE 的新机制。它通过混合软件定义网络 (SDN) 检测和缓解 LFA。SDN 使用 OpenFlow 协议分离控制平面和数据平面。混合 SDN 既有传统节点也有 SDN 节点，在控制平面中有一个控制器。我们使用了基于服务的混合 SDN (SBHS)，这是一种混合SDN。BALANCE 以一种算法开始，该算法选择 AS 中的节点以启用 SBHS，以便控制器可以获取 AS 中所有链路的统计信息。接下来，在控制器中实现拥塞检测和定位算法以找到拥塞的链路。最后，LFA bot 检测和缓解算法在控制器中实现以缓解 LFA。BALANCE 在测试平台和模拟器中进行了评估。我们将结果与最先进的解决方案进行了比较。BALANCE 能够以 97.64% 的精度检测 LFA 机器人，并且在 LFA 攻击期间 HTTP 响应时间为 2 秒。拥塞检测和定位算法在控制器中实现以找到拥塞的链路。最后，LFA bot 检测和缓解算法在控制器中实现以缓解 LFA。BALANCE 在测试平台和模拟器中进行了评估。我们将结果与最先进的解决方案进行了比较。BALANCE 能够以 97.64% 的精度检测 LFA 机器人，并且在 LFA 攻击期间 HTTP 响应时间为 2 秒。拥塞检测和定位算法在控制器中实现以找到拥塞的链路。最后，LFA bot 检测和缓解算法在控制器中实现以缓解 LFA。BALANCE 在测试平台和模拟器中进行了评估。我们将结果与最先进的解决方案进行了比较。BALANCE 能够以 97.64% 的精度检测 LFA 机器人，并且在 LFA 攻击期间 HTTP 响应时间为 2 秒。