# Interest Flooding Attacks in Named Data Networking and Mitigations: Recent Advances and Challenges
## 3 Interest Flooding Attack: Concept and Taxonomy
### Taxonomy of IFA
#### 3.2.3 Target Layer  
IFAs in NDN can target various layers within the architecture, each with distinct vulnerabilities and consequences. An IP DDoS that targets specific hosts, where an IFA exploits NDN's stateful forwarding, as each router maintains a PIT entry for every pending request. Excessive malicious interests can congest network links and exhaust router PIT memory [18; 33], leading to the loss of legitimate requests. IFAs can manifest at different layers of the NDN architecture, mainly the network layer (forwarding plane) and the application layer (content producers), each with distinct attack strategies, impacts, and countermeasures. Next, we detail the vulnerabilities at each layer, how attacks are conducted, and the consequences, followed by mitigation approaches tailored to those layers later. * _Network-Layer IFAs (PIT Exhaustion Attacks):_ NDN routers maintain per-packet state in the PIT, which records each unsatisfied interest's name and incoming interface until a matching data is returned. This stateful design, while enabling robust multipath forwarding and loop prevention, is a double-edged sword: the PIT has a finite size and can be overwhelmed. Attackers exploit this by sending spoofed interests for non-existent content names (or otherwise unsatisfiable requests) at high rates, **filling PIT entries and consuming bandwidth**[33], while enabling robust multipath forwarding and loop prevention. As a result, the router's memory is exhausted, and new interests(even from legitimate users) cannot be added to the PIT. In essence, the PIT exhaustion attack targets the availability of the network layer by incapacitating the ability of the routers to forward requests [18; 33]. The malicious consumers flood the network with unsatisfiable interest packets, exhausting router resources. Attackers request non-existing content, causing PITs to fill up, leading to packet drops and service disruptions. Distributed and slow-start IFAs worsen detection challenges, severely degrading NDN performance. * _Application Layer (Producer-Targeted Attacks):_ Traditional IFAs primarily target routers; however, attackers can also exploit the application layer by overwhelming content producers. In NDN, producers generate data packets upon receiving interest requests. Attackers flood a producer with interests, exhausting its computational and storage resources. Even if PITs remain stable, excessive processing loads can cause service disruption [8; 34]. Two primary vulnerabilities facilitate producer-targeted IFAs: 1. **Computational Overhead**: Every data packet requires cryptographic signing, making dynamic content especially vulnerable. 2. **Cache Bypassing**: Attackers manipulate interest names to prevent caching, forcing producers to serve every request. An attacker can append random components to a popular content name (e.g., /news/video.mp4?session=XYZ), ensuring each request reaches the producer instead of being satisfied by caches. Application-layer IFAs resemble HTTP GET (request) floods but leverage NDN interests. The Collusive IFA (CIFA) involves a rogue producer collaborating with an attacker. Normally, routers detect IFAs by tracking unsatisfied interests. However, in CIFA, the malicious producer fabricates data responses, preventing detection while still straining network resources. Some rogue producers deliberately delay responses, prolonging PIT occupancy without triggering alarms [35]. The consequences of producer-targeted IFAs are severe. Under high interest loads, producers may experience CPU and memory exhaustion, leading to crashes or denial of service. Cache pollution may also occur if malicious data fills storage, reducing the availability of legitimate content. Furthermore, producer failures can shift demand to alternative servers, propagating service degradation across the network [36]. While Table 1 describes the operational characteristics of different types of IFAs, their relationships are more clearly illustrated through a structured taxonomy.