In-Network DDoS Mitigation Mechanism for Vehicle Road Cooperation Network With Victim-Centric Approach

Vehicle road cooperation (VRC) services closely related to personal safety impose stringent requirements on reliability and real-time performance. However, the growing trend of vehicle to network (V2N) connections has significantly intensified the threat of distributed Denial of Service (DDoS) to the end-cloud communication links. To address this challenge, this article introduces a comprehensive DDoS defense architecture for VRC, named in-network DDoS-oriented Balancer, Inspector, and Filter (IDBIF). Leveraging programmable switches, IDBIF adopts an in-network mode to dynamically mitigate volumetric DDoS traffic in real-time, which coordinates three data plane functions for traffic processing: 1) load balancing; 2) packet inspection; and 3) traffic filtering. Our work faces the starved data plane resources and establishes the problem model for high reliability requirements of VRC services when subjected to DDoS attacks. Furthermore, we developed a multiagent hierarchical structure policy gradient (MAHSPG) algorithm that combines the inherent characteristics of DDoS attacks to tackle the runtime deployment of high-dimensional and heterogeneous defense function chains. Simulation experiment results show that the proposed approach alleviates the data plane resource bottleneck and improves the DDoS defense effect by 24.80%, highlighting its advantages in ensuring reliable VRC services.