Resist Interest Flooding Attacks via Entropy–SVM and Jensen–Shannon Divergence in Information-Centric Networking

As an instantiation of information-centric networking, named data networking was proposed. Since the Interests are recorded in the Pending Interest Table (PIT) of the intermediate routers until they receive corresponding Data packets or exceed the expiring time, the attackers can send an excessive number of spoofed Interests to occupy the PITs, which is called Interest Flooding Attack (IFA), to degrade the network performance. Traditional IFA detection methods are simply based on the PIT expiration rate or the Interest satisfaction rate, which cannot distinguish the IFA from other attack approaches. Besides, the traditional threshold-based methods are easily affected by the value of the thresholds. In this article, we propose an IFA detection mechanism based on the support vector machine (SVM), which can detect the IFA timely and accurately. In order to improve the accuracy of the attack detection, we present to use the entropy of the Interest names, the satisfaction rate of the Interests, and the usage of the PIT as the extracted features in the SVM classifier. In addition, we put forward a Jensen-Shannon-divergence-based malicious Interest prefix recognition mechanism. The simulation results validate that the mechanism can help the network to resist the IFA accurately and effectively.