EcoShield: A More Practical Rerouting-Based Defense Against Link Flooding Attacks

Link Flooding Attack (LFA) is a type of distributed denial-of-service attack that isolates the victim area from the network by indirectly overwhelming critical upstream links. This indirect nature forces the victim area to rely on upstream networks for collaborative defense against LFA. For upstream networks, rerouting serves as a rapid and effective defense strategy. However, each rerouting incurs costs for the upstream network, making it reluctant to assist the victim without compensation. Therefore, we propose EcoShield, in which rerouting is regarded as a tradable service and the victim can purchase from relevant networks when needed. To implement EcoShield, we face two challenges: building a collaboration platform to ensure fair service trading and minimizing the victim's defense expense. To this end, we propose a blockchain-based collaborative architecture for rerouting service trading. Furthermore, we propose a cost-efficient collaborative rerouting scheme toward suspicious source domains, which effectively reduces the number of reroutings required, thereby reducing the victim's expense. Finally, extensive experiments demonstrate that, while ensuring effective defense performance (with a botnet identificationprecisionabove 0.95 andrecallabove 0.6), EcoShield reduces the defense expense by at least 45% compared with prior works.