A Collaborative Programmable LFA Defense Using Temporal Graph Learning in AIoT

In the current era of rapid advancements in Artificial Intelligence of Things (AIoT), with the increase in cloud data center operations and the limited security computing capabilities of AIoT terminal devices, link flooding attack (LFA) has emerged as a complex and stealthy new threat. However, the existing defense methods based on programmable networks usually have issues of slow offline inference and delayed defense activation. To address these issues, we propose a collaborative programmable defense framework (CPDTG) to predict, detect, and mitigate LFA. First, an early attack intention prediction model based on temporal graph learning (TGL) is proposed to accurately locate attacks and promptly activate defenses to save resource consumption during idle time. Second, a switch-native clustering algorithm independent of the global perspective is introduced for line-speed detection of LFA. The unsupervised algorithm does not rely on labeled datasets for training, which enhances its robustness against differentiated attack scenarios. Third, we propose a distributed defense mechanism that achieves the pushback deployment of adaptive rate-limiting strategies. Compressing the potential attack vector space effectively increases the difficulty of launching rolling attacks. Extensive experimental validation demonstrates the effectiveness of the proposed CPDTG in predicting and defending against LFA.