|
Traditional DDoS mitigation in IP networks is fundamentally built around addresses, hierarchical name-to-address mappings, and centralized trust anchors.
At the IP layer, defenses include filtering, rate limiting, and traceback. DNS security hardens name servers and enforces authentication and access control. More recently, reputation systems and ML-based intrusion detection also appear, but they still assume host-centric addressing.
In ICN, security is name-centric and cache-centric. Attacks like interest flooding, cache pollution, and content poisoning exploit name-based forwarding and caches. Existing defenses often monitor per-router state such as PIT occupancy, satisfaction ratio, and cache hit behavior, and apply pushback or admission control.
So the mismatch is clear: IP defenses assume addresses; many ICN defenses assume per-hop name-based router state. |