HoneyNet for mitigating link flooding attacks on software-defined networks

Abstract

Over the past years, Link Flooding Attacks(LFAs) have been introduced as new network threats. LFAs are indirect DDoS attacks that selectively flood intermediate links, while legacy DDoS attacks directly aim at end points. As a result, a wide area is isolated from the Internet. In the legacy network, mitigating LFAs is a challenge since an attacker can successfully construct a link map that contains entire network topology via traceroute. Some previous works have been proposed, but, they are ex-post countermeasures that react after LFAs are occurred. In this paper, we present HoneyNet that prelocates nodes that have problematic links, by computing static and dynamic property on Software-defined Networks(SDNs). And HoneyNet deploys Honey Topology which is fake topology on the located nodes, to make the attacker believe that the topology has bottleneck links. \honeynet also forces the attacker to misbuild the link map by reactively routing traceroute packets into the honey topology.