Detection Bottleneck links without multiple nodes

A "Link Flooding Attack" is that does not directly attack the target node, but instead creates a state in which packets cannot reach the target node by congestion of the intermediate link. In general, it is best way to distribute multiple measurement nodes to measure the network and monitor the links that are bottlenecks. In this paper, we propose a method to detect a bottleneck link, that is attacked, by a single node, without requiring multiple measurement nodes. Next, we show the effectiveness of our proposal method using a network topology by a topology generator. Finally, we detect links that may be bottleneck links by applying our proposal method to the actual Traceroute data.