In recent years, the frequency and severity of network attacks have increased significantly, posing serious threats to network security. Network topology information is often exploited by attackers to identify critical bottlenecks, which are prime targets for attacks. Typically, attackers probe the network topology using network tomography or traceroute. Network tomography, compared to traditional methods like traceroute, offers greater flexibility and is more challenging to detect. These characteristics make it a preferred technique for attackers. In response, network operators seek to implement topology obfuscation strategies that expose a deliberately designed fake topology to mislead attackers. However, existing obfuscation techniques against network tomography have primarily focused on protecting tree-like topologies and have been insufficient in concealing bottleneck nodes and links. To this end, we propose TopoFaker, a novel topology obfuscation system designed to protect general network topologies while effectively concealing bottleneck nodes and links. TopoFaker consists of three main components: a topology generator that creates secure fake topologies, a policy deployer that ensures attackers perceive only the obfuscated topology, and obfuscation nodes that implement proactive delay policies in the data plane. Experimental evaluations on real-world network topologies demonstrate that TopoFaker effectively enhances network security by obscuring bottleneck nodes and links, achieving a 73.99% reduction in maximum degree centrality and a 79.48% reduction in maximum edge connectivity. Furthermore, TopoFaker reduces the average proactive delay time by 50.82%, minimizing the negative impact on normal packets misclassified due to the classifier’s false alarms. TopoFaker outperforms existing mechanisms by achieving a runtime of under one minute and reducing memory allocation by four orders of magnitude on large-scale problems.

Many network attacks, like link flooding attacks (LFAs), heavily rely on network topology information. Therefore, network topology obfuscation has been applied to counteract network topology inference and prevent topology information leakage. One effective way is to scheme a fake topology intentionally for attackers to map out. Focusing on reducing the similarity between the real and fake topologies, however, existing methods cannot promise that critical information of the network, such as critical nodes and links, is well hidden. To this end, we propose a new topology obfuscation mechanism, namely ChameleonNet, to protect the critical topology information of a given network. Specifically, ChameleonNet achieves topology obfuscation through a two-stage operation: 1) generating fake topology and 2) deploying fake topology. Our experiments on three real-world and two large-scale generated network topologies demonstrate that ChameleonNet can effectively reduce similarity between inferred and real topologies by 31%-37% and reliably hide critical topology information in terms of multiple statistical metrics.

Each flow usually needs to traverse a specific service function chain (SFC), which is composed of multiple network functions implemented through virtualization technology or hardware, before reaching their destinations. All network functions are deployed across commodity nodes inside a network environment. Each flow needs to change its default routing path to visit the corresponding SFC correctly. These changed routing paths will cause network load imbalance. Therefore, an intelligent routing planning method is needed to balance the traffic load while satisfying various SFC requirements of different flows. In this paper, we propose to leverage SRv6, a new routing technology, to centrally plan the routing path for each flow with any SFC request. We then present a general model of the SFC planning problem (SFCP), planning flows’ routing paths to minimize the maximum link utilization of the network, and prove that the problem is NP-hard. For this reason, we transform the SFCP problem into a graph theory optimization problem and propose SFCPlanner, an online SFC planning method based on deep reinforcement learning. Moreover, we design the node mask and incremental training mechanisms to make SFCPlanner achieve better performance. The experiment results show that our SFCPlanner can solve the SFCP problem in large-scale networks more precisely. It can reduce the maximum link utilization by 32% compared with the benchmark algorithm while ensuring each flow traverses the correct SFC.