## 7 Attack and Countermeasure Designs
### Countermeasure Design  
To mitigate the side-channel timing attacks in NDN, preconfigured configurations (namely countermeasures) can be used. These can be stated as cache disabled and available methods. The cache disabled approaches are providing a \"_perfect privacy_\" for the NDN cache privacy. For instance, the CS can be configured to not cache any content. An attack cannot be carried out or succeed if the content is not held in the cache [2]. For instance, the NDN anonymity tool (ANDaNA [6]) provides privacy and anonymity to the consumers. In ANDaNA, each of the requested content names is encrypted and then verified by the NDN routers. The cache available methods are used to increase (or manipulate) the CRT value for all connected interfaces (legitimate and adversary) of the edge router. Through different CRT values, an adversary may not able to distinguish between uncached and cached targets of the NDN router. These methods are based on delay, random caching to CS as discussed by [2; 10; 11; 40]. However, the cache disabled and available countermeasures may not be the most efficient approaches because the configuration of the NDN edge router is static. These configurations may reduce the NDN content distribution efficiency for legitimate NDN requests because of undesired transmission delays from the edge router. To overcome or minimize countermeasures efficiency issues, detection and defense (DaD) countermeasure was proposed previously by [36; 38]. In this work, the DaD was upgraded to advance adversary detection of the NDN nodes. DaD is offering an attack detection mechanism to distinguish between the adversarial and legitimate nodes to apply countermeasures to the adversary nodes. To achieve that, the cache hit ratio (CHR) can be calculated for the \"privacy sensible\" contents at the NDN application layer (e.g., NFD) of the edge router. The CHR is expressed by the following equation:  
\[CHR=\frac{\sum_{k=1}^{n}{(total\_cache\_hits)_{k}}}{R}\times 100\% \tag{2}\]  
where \(n\) is the total number of the edge routers in the network, and \(R\) is the total number of requests received by the edge routers, which is equal to the total number of cache hits plus the total number of cache misses. In DaD, the CHR threshold value is used. If an interface's CHR value measure is higher than the threshold, that interface is considered an adversary of the router (this scenario is considered in the edge routers). The CHR threshold (3) parameter is calculated in DaD. A set of \(m\) requests is collected regularly during \(\Delta T\) seconds. The total number of cache hits is calculated for the new set of requests, which we consider to be the \(i\)th collected set. Thus, the average CHR of this new set (\(chr_{i}\)) is calculated by the following equation:  
\[chr_{i}=\frac{\sum_{k=1}^{m}{CH_{k}}}{m} \tag{3}\]  
where \(CH_{k}\) represents the cache hit of the \(k\)th request in the new set. The \(CH_{k}\) is one if the \(k\)th request obtains a cache hit, and zero in case of a cache miss. Then, the new global average \(CHR_{j}\) is computed by the following weighted moving average equation:  
\[CHR_{j}=(\alpha\times CHR_{j-1})+(1-\alpha)\times(chr_{i}) \tag{4}\]  
where \(CHR_{j-1}\) represents the last CHR value, \(chr_{i}\) is the new value calculated by Equation (3), and \(\alpha\) is a weight factor between 0 and 1. The \(CHR_{j}\) is very sensible to the new \(chr_{i}\) value if \(\alpha\) is close to 0, and is not very sensible if \(\alpha\) is close to 1. In DaD, \(\alpha\) should be chosen close to 0, because an attack increases the \(CHR_{i}\) when it is established, and so the system can detect it quickly. For this reason, \(\alpha\) was set close to 0 in our experimental ndnSIM scenario. The router is considered under attack if \(CHR_{j}\) is higher than the threshold CHR. The CHR threshold was defined as \(\approx\)5% in NDN streaming applications (name privacy). This work used the CHR threshold to show the possibility of adversary detection, also defining attack severity.