NetObfu: A lightweight and efficient network topology obfuscation defense scheme

Link flooding attack (LFA) is an attack based on network topology information. It has been one of the major threats to the Internet due to its low cost and high concealability feature. Existing active defenses against LFA either rely on additional methods to detect malicious traffic or lower the usefulness of network diagnostic tools for benign purpose. In this paper, a lightweight, low-loss network topology obfuscation scheme is proposed. We have designed a set of efficient algorithms that can calculate a secure virtual topology for a large topology of hundreds of nodes in a few seconds, hiding important links in the network while luring attackers to preset honey links. Then, we control different nodes to respond to the probe packets in accordance with the virtual topology. There is no need to reroute flows or add additional header information in the forwarding process, so we can capture and modify the packets at the line-rate. We implemented the prototype of NetObfu in the SDN environment, and evaluated it through a large scale of experiments with different real topologies. The results confirmed the effectiveness and efficiency of our solution.