Link Flooding Attacks (LFA) exploit network topology knowledge to disrupt connectivity by targeting critical links and nodes. Existing defenses often presuppose an attacker with complete topological awareness and overlook the concentration of attack traffic on specific routers. Furthermore, many countermeasures rely on SDN, which can suffer from performance degradation due to the limited packet processing capabilities of switches. To address these issues, we introduce the GateLFA attacker model, which assumes that attackers lack complete topology knowledge and guide their attacks based on traffic density analysis. We propose the EqualFlow algorithm, which utilizes stub node relocation and insertion to minimize adversarial impact, balance attack traffic, and reduce defense costs. Additionally, we present the Network Topology Obfuscation System, leveraging XDP for high-speed packet processing at the network boundary to overcome the performance challenges of SDN-based solutions. Our experimental results demonstrate that EqualFlow computes high-quality virtual topologies, outperforming existing algorithms across small, medium, and large-scale networks. Moreover, the Network Topology Obfuscation System effectively disrupts prominent topology probing tools through explicit information interference at a 10 Gbps line rate. For implicit interference, the system increases the packet rate of typical traceroute probes by approximately 17% compared to traffic control methods. This research provides an efficient and practical solution for defending against LFA.

The rapid proliferation of IoT devices presents a two-fold challenge: a pronounced deficiency in security measures and a diverse array of Quality of Service (QoS) requirements. For network providers to address these challenges effectively, it is paramount first accurately to identify IoT devices. Current methodologies fall short in their robustness, owing to encrypted traffic and the intricate network environments. This paper applies multi-feature time series to the problem of encrypted IoT device traffic classification, proposing a multi-dimensional time series-based IoT traffic classification method, MTS-IoT. MTS-IoT constructs multi-dimensional time series samples from raw traffic using sliding windows of fixed packet numbers, preserving abundant information. It then utilizes a "Global-Local-Spacial" framework to deeply extract sequence features and introduces sparse self-attention to reduce the training overhead caused by multi-dimensional temporal features. Comprehensive experiments were conducted on a renowned dataset, in which we retained the traffic of non-IoT devices to simulate the real world. Experiments indicate that MTS-IoT outperforms existing methods in classification performance, pushing the F1 to 98.63%(4.46%↑). Moreover, it can achieve accurate detection throughout the entire traffic cycle, resist network congestion, and resist traffic shaping, underscoring its robustness in diverse scenarios.

It is crucial to distinguish the network entities (NEs) behind NAT devices for tasks such as information gathering, asset management, and legal interception. The current mainstream approach has the problem of erroneously clustering traffic from a sparsely communicating NE as traffic from multiple NE. This leads to current algorithms not being able to be applied effectively in real environment. To address this issue, we propose a Linux NEs traffic clustering method based on TCP/IP features in this paper. We integrate multiple hidden level features such as operating system and timestamp and freely cluster the data set based on the density of spatial distribution. We use the datasets from the real campus network and public dataset to evaluate the performance of our method, and the results show that our method overcomes the problem erroneously clustering traffic from a sparsely communicating NE as traffic from multiple NEs. For the current mainstream Linux types, the purity of each version exceeds 0.91, RI exceeds 0.98, ARI exceeds 0.88, and FMI exceeds 0.89. Our method can accurately calculate the number of hosts behind NAT and cluster traffic accordingly.

DNS, as a vital component of the Internet, is frequently exploited for malicious activities. Millions of open DNS resolvers are exposed with public access, posing significant risks. Amplification vulnerability in UDP-based DNS protocol has been abused by miscreants to launch reflection amplification Distributed Denial of Service (DDoS) attacks. In reflection amplification attacks, forged DNS request packets are continuously sent to open resolvers, triggering amplified attack traffic against the targeted victim. To defend against such attacks, resolvers can take measures to reject anomalous requests and limit the size of responses. Measures such as source address verification and response rate limiting prove effective in mitigating the risk of resolver exploitation. However, implementing these measures requires software and hardware updates or configuration changes, potentially incurring additional costs. Currently, it remains unclear how many open resolvers are adequately protected and how many still pose the potential for exploitation. In this paper, we conducted a thorough measurement on open resolvers about the actual potential of abuse. Our measurement results indicated that 14.9% of open resolvers are susceptible to exploitation for reflection-based DDoS attacks and thousands of resolvers are still exposed to reflection amplification attacks with no mitigation measure.