Mitigating Crossfire Attacks via Topology Spoofing Based on ENRNN-MTD
Source abstract
Abstract
Crossfire attacks disrupt network services by targeting critical links of server groups, causing traffic congestion and server failures that prevent legitimate users from accessing services. To counter this threat, this study proposes a novel topology spoofing defense mechanism based on a sequence-based Graph Neural Network–Moving Target Defense (ENRNN-MTD). During the reconnaissance phase, the method employs a GNN to generate multiple random and diverse virtual topologies, which are mapped to various external hosts. This obscures the real internal network structure and complicates the attacker’s ability to accurately identify it. In the attack phase, an IP random-hopping mechanism using a chaotic sequence is introduced to conceal node information and increase the cost of launching attacks, thereby enhancing the protection of critical services. Experimental results demonstrate that, compared to existing defense mechanisms, the proposed approach exhibits significant advantages in terms of deception topology randomness, defensive effectiveness, and system load management.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software-Defined Networks and 5G · Network Security and Intrusion Detection · Advanced Graph Neural Networks
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Cryptography Engineering, Information Engineering University, Zhengzhou 450001, China
Henan Key Laboratory of Information Security, Zhengzhou 450001, China
Funding
Postdoctoral Fellowship Program of CPSF · Natural Science Foundation of Henan Province
References (37)
Show source-provided references
1. Towards Crossfire Distributed Denial of Service Attack Protection Using Intent-Based Moving Target Defense Over Software-Defined Networking10.1109/ACCESS.2021.3103845 ↗
2. Cheng, S.Y. (2024). Intelligent Detection and Defense Methods of Link Flooding Attacks. [Ph.D. Thesis, University of Science and Technology of China].
3. Crossfire attack defense method based on software defined network
4. A survey of link flooding attacks in software defined network ecosystems10.1016/j.jnca.2020.102803 ↗
5. Wang, Q., Xiao, F., Zhou, M., and Wang, Z. (2017). Linkbait: Active link obfuscation to thwart link-flooding attacks. arXiv.
6. Kang, M.S., Gligor, V.D., and Sekar, V. (2016, January 21–24). SPIFFY: Inducing CostDetectability Tradeoffs for Persistent Link-Flooding Attacks. Proceedings of the Network and Distributed System Security Symposium, San Diego, CA, USA.10.14722/ndss.2016.23147 ↗
7. Kim, J., Marin, E., Conti, M., and Shin, S. (2022, January 24–28). EqualNet: A Secure and Practical Defense for Long-term Network Topology Obfuscation. Proceedings of the 2022 Network and Distributed System Security Symposium, San Diego, CA, USA.10.14722/ndss.2022.23154 ↗
8. A Persistent Route Diversification Mechanism for Defending Against Stealthy Crossfire Attack10.1155/2022/2566681 ↗
9. Lu, Z.C. (2024). Low-Rate Denial of Service Attack Defense Method Based on Moving Target Defense Technology in SDN. [Ph.D. Thesis, Civil Aviation University of China].
10. Trassare, S.T., Beverly, R., and Alderson, D. (2013, January 18–20). A technique for network topology deception. Proceedings of the MILCOM 2013-2013 IEEE Military Communications Conference, San Diego, CA, USA.10.1109/MILCOM.2013.303 ↗
11. Meier, R., Tsankov, P., Lenders, V., Vanbever, L., and Vechev, M. (2018, January 15–17). NetHide: Secure and Practical Network Topology Obfuscation. Proceedings of the USENIX Security Symposium, Baltimore, MD, USA.
12. Aydeger, A., Saputro, N., and Akkaya, K. (2018, January 29–31). Utilizing NFV for Effective Moving Target Defense Against Link Flooding Reconnaissance Attacks. Proceedings of the MILCOM 2018 IEEE Military Communications Conference (MILCOM), Los Angeles, CA, USA.10.1109/MILCOM.2018.8599803 ↗
13. Achleitner, S., La Porta, T., McDaniel, P., Sugrim, S., Krishnamurthy, S.V., and Chadha, R. (2016, January 28). Cyber Deception: Virtual Networks to Defend Insider Reconnaissance. Proceedings of the Workshop on Managing Insider Security Threats, Vienna, Austria.10.1145/2995959.2995962 ↗
14. CGAN-based cyber deception framework against reconnaissance attacks in ICS10.1016/j.comnet.2024.110655 ↗
15. Eshratifar, A.E., Esmaili, A., and Pedram, M. (2019, January 29–31). BottleNet: A Deep Learning Architecture for Intelligent Mobile Cloud Computing Services. Proceedings of the 2019 IEEE/ACM International Symposium on Low Power Electronics and Design (ISLPED), Lausanne, Switzerland.10.1109/ISLPED.2019.8824955 ↗
16. Kim, J., and Shin, S. (2017, January 26–29). Software-defined HoneyNet: Towards mitigating link flooding attacks. Proceedings of the 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSNW), Denver, CO, USA.10.1109/DSN-W.2017.10 ↗
17. Emergence of scaling in random networks10.1126/science.286.5439.509 ↗
18. NetObfu: A lightweight and efficient network topology obfuscation defense scheme10.1016/j.cose.2021.102447 ↗
19. Jin, W., Barzilay, R., and Jaakkola, T. (2018, January 10–15). Junction tree variational autoencoder for molecular graph generation. Proceedings of the 35th International Conference on Machine Learning (ICML), Stockholm, Sweden.
20. Simonovsky, M., and Komodakis, N. (2018, January 4–7). GraphVAE: Towards generation of small graphs using variational autoencoders. Proceedings of the International Conference on Artificial Neural Networks (ICANN), Rhodes, Greece.10.1007/978-3-030-01418-6_41 ↗
21. NeVAE: A deep generative model for molecular graphs
22. Bojchevski, A., Shchur, O., Zügner, D., and Günnemann, S. (2018, January 10–15). Netgan: Generating graphs via random walks. Proceedings of the International Conference on Machine Learning (ICML), Stockholm, Sweden.
23. Guimaraes, G.L., Sanchez-Lengeling, B., Outeiral, C., Farias, P.L., and Aspuru-Guzik, A. (2017). Objective-reinforced generative adversarial networks (ORGAN) for sequence generation models. arXiv.
24. De Cao, N., and Kipf, T. (2018). MolGAN: An implicit generative model for small molecular graphs. arXiv.
25. Yang, C., Zhuang, P., Shi, W., Luu, A., and Li, P. (2019, January 8–14). Conditional structure generation through graph variational generative adversarial nets. Proceedings of the Neural Information Proceedings Systems (NIPS), Vancouver, BC, Canada.
26. You, J., Ying, R., Ren, X., Hamilton, W., and Leskovec, J. (2018, January 10–15). GraphRNN: Generating realistic graphs with deep auto-regressive models. Proceedings of the International Conference on Machine Learning (ICML), Stockholm, Sweden.
27. Li, Y., Vinyals, O., Dyer, C., Pascanu, R., and Battaglia, P. (2018). Learning deep generative models of graphs. arXiv.
28. Bjerrum, E.J., and Threlfall, R. (2017). Molecular generation with recurrent neural networks (RNNs). arXiv.
29. Sharma, D.P., Kim, D.S., Yoon, S., Lim, H., Cho, J.H., and Moore, T.J. (2018, January 1–3). FRVM: Flexible Random Virtual IP Multiplexing in Software-defined Networks. Proceedings of the IEEE 2018 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/12th IEEE International Conference On Big Data Science and Engineering (TrustCom/BigDataSE), New York, NY, USA.10.1109/TrustCom/BigDataSE.2018.00088 ↗
30. Jafarian, J.H., Al-Shaer, E., and Duan, Q. (2012, January 13). Openflow random host mutation: Transparent moving target defense using software defined networking. Proceedings of the 1st Workshop on Hot Topics in Software Defined Networks, Helsinki, Finland.10.1145/2342441.2342467 ↗
31. Jafarian, J.H.H., Al-Shaer, E., and Duan, Q. (2014, January 3). Spatio-Temporal address mutation for proactive cyber agility against sophisticated attackers. Proceedings of the 1st ACM Workshop on Moving Target Defense, Scottsdale, AZ, USA.10.1145/2663474.2663483 ↗
32. Wang, S., Zhang, L., and Tang, C. (2016, January 20–22). A new dynamic address solution for moving target defense. Proceedings of the Information Technology, Networking, Electronic and Automation Control Conference IEEE, Chongqing, China.10.1109/ITNEC.2016.7560545 ↗
33. Makanju, A., Zincir-Heywood, A.N., and Kiyomoto, S. (2017, January 15–19). On evolutionary computation for moving target defense in software defined networks. Proceedings of the Genetic and Evolutionary Computation Conference on Companion, Berlin, Germany.10.1145/3067695.3075604 ↗
34. Securing ICS networks: SDN-based automated traffic control and MTD defensive framework against DDoS attacks10.1016/j.comcom.2025.108252 ↗
35. SDN address hopping scheme based on chaotic sequence
36. Feng, W. (2013). Research and Implementation of Address Port Dynamic Hopping Technology in Network Communication. [Ph.D. Thesis, Huazhong University of Science and Technology].
37. The internet topology zoo10.1109/JSAC.2011.111002 ↗