Detecting Congestion-Related Attacks via Fine-Grained Queue Diagnosis

As modern networks are increasingly demanding performance, it is crucial to protect network resources from attack threats. Congestion-Related Attacks (CRAs) have become a serious threat to network infrastructures, which can cause severe degradation of network performance. The emerging programmable switch makes it possible to offload intelligence to the data plane, providing an opportunity to deploy defense strategies against CRAs in the data plane. In this paper, we present the Fine-Grained Queue Diagnosis (FGQD) system deployed on the programmable switch, capable of real-time monitoring of the queue and network traffic to defend against CRAs. Specifically, we propose culprit flows for congestion and active flows during congestion to track the flows culpable for congestion formation and those exhibiting abnormal activity during congestion. To effectively recognize these flows, we design the approximate data structure Time-Windows to overcome the resource and operational constraints on the programmable data plane. Furthermore, we employ an in-network machine learning model that utilizes queue and packet features to identify malicious flows of CRAs. Extensive experiments on the software-based testbed show that FGQD achieves 97.333% detection rate with remarkably low false positive rates of 0.018% and 0.106% when detecting Shrew attacks and Optimistic Ack attacks, outperforming existing methods including Conquest, Henna, and Hashpipe. Moreover, FGQD responds to Shrew attacks within 5.70 milliseconds, which is orders of magnitude faster than SDN-based control plane solutions that typically require seconds to respond. These results conclusively demonstrate FGQD’s exceptional effectiveness in defending against CRAs.