LinkGuard: Link Flooding Attack Detection and Mitigation via Spatio-Temporal Graph Convolutional Network

Link Flooding Attack (LFA) is a new genre of DDoS attacks that aims to isolate the target area by paralyzing the critical links. To defend against LFA, we propose a novel LFA detection and mitigation system named LinkGuard using SDN. The changes in link state generally follow certain spatio-temporal patterns, whereas LFA is usually an unexpected or abrupt action that may break the normal traffic pattern. Based on this idea, we conceive an LFA detection method using an attention-based spatio-temporal graph convolutional network, which can infer the abnormal performance degradation induced by LFA. However, it is hard to get enough attack data for model training in reality. To tackle this difficulty, we propose an extreme value theory based model to estimate the probability that the performance degradation is caused by an extreme LFA event. In this way, the detection model can work without any prior knowledge of LFA. We further propose a mitigation method based on traffic rerouting and filtering to purify the LFA. We construct a test bed using a cluster of virtual machines and real network traffic to evaluate the performance. Extensive experiments demonstrate that LinkGuard can accurately detect LFA attacks and can effectively relieve the performance degradation caused by LFA.