Isolation Forest Based Interest Flooding Attack Detection Mechanism in NDN

Interest flooding attack (IFA) can considerably harm named data networking (NDN). To prevent an IFA, in this paper, we propose an isolation forest (iForest) based IFA detection mechanism and provide a countermeasure. In this mechanism, the iForest is constructed based on the prefixes of interest packets, where the abnormal prefixes are isolated closer to the root node, and the normal prefixes are isolated farther from the root node. Furthermore, we detect malicious prefixes from abnormal prefixes according to the usage of pending interest table (PIT); thus, the forwarding of interest packets with malicious prefixes is restricted, and the influences of IFA are reduced. Simulation results show that the proposed mechanism can effectively increase the number of data packets received by consumers, thus mitigating IFA.