University of Padua

Internet has been one of the most successful inventions in the last fifty years. Thanks to its fast widespread availability has become the standard way for world communications. The emerging usage models and new access methods expose some limitations of the current Internet architecture, that was conceived back in 1970-s. Content-Centric Networking (CCN) is an emerging networking paradigm being considered as a possible replacement for the current IP-based host-centric Internet infrastructure. In CCN, content becomes a first-class entity and is directly named. CCN focuses on content distribution, which dominates current Internet tra c and is arguably not well served by IP. Named-Data Networking (NDN) is an example of CCN. NDN is also an active research project under the NSF-sponsored Future Internet Architectures (FIA) program. FIA emphasizes security and privacy from the outset and by design. To be a viable Internet architecture, NDN must be resilient against current and emerging threats. This thesis tries to give its contribution to the development of this new architecture. This thesis focuses on distributed denial-of-service (DDoS) attacks, especially, interest flooding – an attack class that exploits key architectural features of the NDN architecture. We initially show that Interest Flooding Attacks (IFA) is a realistic threat and we demonstrate how to implement it. We show an adversary with limited resources can use such attacks to significantly influence network performance. We provide simulations on more than one topology to obtain better and more realistic results. We then introduce Poseidon: a toolkit for detecting and mitigating interest flooding attacks. We also report on the results of extensive simulations aimed at assessing e↵ectiveness of our countermeasure.