Named Data Networking (NDN) has emerged as a promising network paradigm for the future Internet. It revolutionizes content retrieval by decoupling it from specific locations, thereby overcoming the limitations of traditional IP addressing and significantly enhancing data delivery efficiency. Additionally, NDN’s stateful forwarding plane for routers enables robust aggregation of identical requests, bolstering resistance against Distributed Denial of Service (DDoS) attacks. Despite these advancements, NDN remains vulnerable to the Interest Flooding Attack (IFA), wherein excessive requests from attackers can compromise transmission quality by depleting router resources. In the current landscape, researchers have proposed various strategies aimed at improving the accuracy, timeliness, and cost-effectiveness of defenses against IFA attacks, presuming stable user behavior. However, several challenges persist in effectively countering IFA attacks, including the need to ensure transmission quality throughout users’ lifecycles, eliminate attacks at their origin, and adapt to dynamic user behaviors. In response to these challenges, this paper presents the Hybrid Proactive Reactive Defense Scheme (HPR-DS). HPR-DS employs distinct proactive and reactive modules for resource management and user behavior analysis, respectively, at intermediate and edge nodes. It employs time series analysis to gauge evolving resource requirements and maintains separate resource pools for each content. Additionally, HPR-DS utilizes multidimensional data clustering to accurately identify attackers. Simulation results demonstrate the superior performance of HPR-DS in safeguarding user transmission quality throughout the entirety of their lifecycle and in enhancing detection precision in dynamic network environments.

Named Data Networking (NDN) stands out as a promising Information Centric Networking architecture capable of facilitating large-scale content distribution through in-network caching and location-independent data access. However, attackers can easily inject poisoned content into the network, called content poisoning attacks, which leads to a substantial deterioration in user experience and transmission efficiency. In existing schemes, routers fail to determine the contamination source of received poisoned content, leading to the inability to accurately identify attacker nodes. Besides, attackers’ dynamic behaviors and network instability could disrupt identification results. In this paper, we propose a Secure and Lightweight scheme against content poisoning attacks based on Probing (SLP), where a proactive and reliable probing protocol is designed to identify adversaries quickly and precisely. In SLP, a router sends specifically chosen interest packets to probe a suspicious node, so that the returned corresponding content can straightly reflect its trustworthiness without other nodes’ interference. In addition, a hypothesis testing algorithm is developed to analyze the returned content, which can exclude the impact of transmission errors and adapt to dynamic attackers. Moreover, we utilize users’ feedback to avoid unnecessary probing costs on unaffected routers, with its reliability guaranteed by an efficient cuckoo-filter-based feedback validation mechanism. Security analysis shows that SLP achieves resistance against content poisoning attacks and malicious feedback. The experimental results demonstrate that SLP makes users hardly be affected by attacks and brings in only slight overhead.

As a promising implementation of Information Centric Networking, Named Data Networking (NDN) can facilitate content distribution with in-network caching and location-independent data access. However, the reliance on caches makes NDN vulnerable to content poisoning attacks, which waste network resources and decrease transmission efficiency. Most mitigating schemes follow the pattern that each content is repeatedly verified individually in each router and all producers have the same status, which wastes computation resources and degrades network performance. In this paper, we propose a Reputation-based Probabilistic Batch Verification (RPBV) scheme to address the issue, in which producers’ reputation is estimated according to verification results to distinguish different producers. We provide an adaptive probabilistic verification method based on reputation to avoid a lot of unnecessary verification operations. At the same time, we adopt an efficient batch verification algorithm to simultaneously verify multiple content, which reduces the overhead greatly. With the above mechanisms implemented only on the edge router to avoid repeated verification, we provide an optional probabilistic verification method on intermediate routers to strengthen the security. The extensive simulations show that RPBV achieves much lower computation overhead and shorter content retrieval time than the traditional schemes.