# Interest Flooding Attacks in Named Data Networking and Mitigations: Recent Advances and Challenges
## 4 State of the Art Detection and Mitigation Strategies
### PIT Management Strategies  
Pending Interest Table (PIT) management (or \"Interest-PIT decoupling\") strategies aim to prevent an IFA from filling up the PIT by altering how the pending state is handled. One approach is decoupling pending states from the PIT for suspect interests, effectively not storing per-interest state for them. A DPE (Decoupling Pending Entries), which appends an interface list into the interest packet itself instead of creating a PIT entry, was proposed [38]. This way, routers do not allocate PIT memory for those interests; the interface list in the packet serves to route the returning data. Similarly, a cryptographic route token, which encodes the path or incoming interface in a verifiable token, was introduced in each interest. With a route token, a router can forward the data back without storing a PIT entry since the token helps it identify the origin interface [39].  
In addition, architectural modifications were introduced to operate the NDN in a PIT-less mode for certain traffic [40]. Another line of PIT management involves purging or controlling PIT entries during an aggressive attack. For instance, an approach might detect a surge of timed-out entries and respond by flushing those entries and temporarily not admitting new interests for the offending prefix/interface. The _ChoKIFA+ system_ uses an Active Queue Management technique (CHOKe) at the router to selectively drop pending interests that appear malicious, freeing PIT space. In ChoKIFA, when the PIT is under stress, the router randomly drops some incoming malicious interests and simultaneously  
\begin{table}
\begin{tabular}{p{85.4 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Technique** & **Main Idea** & **Strengths** & **Weaknesses** & **Computing Complexity** \\ \hline Rate Limiting & Throttle interfaces based on unsatisfied interest rate & Simple, lightweight, easy to deploy & May penalize legitimate bursts of traffic & Low \\ \hline PIT Management & Modify or bypass PIT storage to reduce overload & Targets core vulnerability directly & Risks breaking interest–data matching semantics & Medium \\ \hline ML/AI-Based & Learn and classify traffic patterns as normal or malicious & Adaptive to evolving attacks, detects stealthy behavior & Requires training data, high resource usage & High \\ \hline Trust/Reputation & Score consumers based on behavior history & Gradual mitigation, works in distributed settings & Cold-start problem, susceptible to Sybil or collusion & Medium \\ \hline Blockchain-Based & Use shared ledgers or smart contracts to validate behavior & Tamper-proof, ensures accountability and traceability & High latency, storage, and consensus overhead & High \\ \hline \hline \end{tabular}
\end{table}
Table 2: Comparison of IFA mitigation techniques.  
evicts matching pending entries from the PIT, thus cleaning up the state associated with the attack traffic [22].  
PIT management solutions directly address the root cause of DoS, PIT exhaustion. By not storing (or quickly removing) state for bogus requests, they preserve memory for legitimate interests. Approaches such as route tokens and DPE show that it is possible to maintain NDN's data return functionality without per interest state, thereby making routers much less vulnerable to flooding. Schemes that remove malicious entries can rapidly reclaim resources once an attack is detected and can restore service to legitimate users.