| Title | Triangle Area Based Multivariate Correlation Analysis for Detecting and Mitigating Cache Pollution Attacks in Named Data Networking |
| Publication Type | Conference Paper |
| Year of Publication | 2020 |
| Authors | Sohail, Muhammad, Zheng, Quan, Rezaiefar, Zeinab, Khan, Muhammad Alamgeer, Ullah, Rizwan, Tan, Xiaobin, Yang, Jian, Yuan, Liu |
| Conference Name | 2020 3rd International Conference on Hot Information-Centric Networking (HotICN) |
| Date Published | dec |
| Keywords | anomaly detection, Correlation, False Locality, feature extraction, in-network caching, information-centric networking, Locality Disruptions, machine learning, Multivariate Correlation Analysis, named data networking, Pollution, Predictive Metrics, pubcrawl, Resiliency, Router Systems Security, security |
| Abstract | The key feature of NDN is in-network caching that every router has its cache to store data for future use, thus improve the usage of the network bandwidth and reduce the network latency. However, in-network caching increases the security risks - cache pollution attacks (CPA), which includes locality disruption (ruining the cache locality by sending random requests for unpopular contents to make them popular) and False Locality (introducing unpopular contents in the router's cache by sending requests for a set of unpopular contents). In this paper, we propose a machine learning method, named Triangle Area Based Multivariate Correlation Analysis (TAB-MCA) that detects the cache pollution attacks in NDN. This detection system has two parts, the triangle-area-based MCA technique, and the threshold-based anomaly detection technique. The TAB-MCA technique is used to extract hidden geometrical correlations between two distinct features for all possible permutations and the threshold-based anomaly detection technique. This technique helps our model to be able to distinguish attacks from legitimate traffic records without requiring prior knowledge. Our technique detects locality disruption, false locality, and combination of the two with high accuracy. Implementation of XC-topology, the proposed method shows high efficiency in mitigating these attacks. In comparison to other ML-methods, our proposed method has a low overhead cost in mitigating CPA as it doesn't require attackers' prior knowledge. Additionally, our method can also detect non-uniform attack distributions. |
| DOI | 10.1109/HotICN50779.2020.9350746 |
| Citation Key | sohail_triangle_2020 |
Triangle Area Based Multivariate Correlation Analysis for Detecting and Mitigating Cache Pollution Attacks in Named Data Networking