# XGBoost-Based Detection of DDoS Attacks in Named Data Networking
## 1 Introduction  
Named Data Networking (NDN) [1] is a proposed future Internet architecture that significantly optimizes data distribution efficiency by leveraging name-based addressing and in-network caching mechanisms. Its content naming rules allow data packets to be cached directly on routers and forwarded through name prefix matching. This approach not only reduces the overhead of the traditional network Domain Name System (DNS), but also effectively reduces network latency through multicast capabilities and dynamic caching strategies, especially in high-mobility scenarios. In addition, NDN embeds security into the data itself through content object signing and ensures integrity verification through encrypted signatures. Compared with TCP/IP's reliance on transport layer encryption (such as TLS/SSL), this model is more in line with future data-driven security needs. However, NDN's unique architecture also brings new security challenges, namely denial of service attacks. DoS attacks in TCP/IP networks and NDN have both similarities and differences. Both are distributed, use a large number of requests or packets to exhaust resources, and the source of the attack may be disguised. DDoS attacks in traditional networks and NDN differ significantly in both targets and methods [2]. In traditional networks, DDoS attackers usually target specific IP addresses. In NDN, DDoS attackers aim to exhaust network resources by sending a large number of interest packets, which not only overload content servers but also cache nodes and intermediate routing nodes. In addition, traditional DDoS attacks are usually implemented using techniques such as SYN flooding and UDPflooding, while attackers in NDN take advantage of its unique data center architecture and introduce unique attack modes such as Interest Flooding Attack (IFA) [3] and content poisoning. Attackers can use IFA to send false requests to the network to exhaust pending interest table (PIT) [4] resources, or manipulate cache replacement strategies through cache pollution attack (CPA) [5] to reduce cache hit rate. Despite these challenges, NDN still provides innovative solutions to key issues in traditional IP networks, such as mobility bottlenecks and redundant data transmission, through dynamic signature verification and distributed trust management. The design and optimization of NDN security mechanisms remain a focus of future research. Flooding attacks encompass various forms, including the IFA, Collusive Interest Flooding Attack (CIFA) [6], and the Improved Collusive Interest Flooding Attack (I-CIFA) [7]. Combining the significant attack potency of IFA with the strong concealment ability of CIFA, I-CIFA has a better attack effect than both in large topologies. The PIT in NDN routers can be depleted due to the reception of a large number of collusive data packets, which results in the occurrence of an I-CIFA attack. Combining the two types of attacks (CPA and I-CIFA) can cause even greater harm, which we refer to as I-CIFPA [8], achieved by simultaneously launching a Cache Pollution Attack and an Improved Collusive Interest Flooding Attack. In response to this type of attack, we propose an improved XGBoost, a multiclassification-based algorithm to detect interval attacks. Based on this method, the contributions of this paper include the following three points:  
* The limitations of the I-CIFPA model are analyzed, and an improved XGBoost-based detection algorithm is proposed, incorporating optimized feature selection and hyper-parameter tuning to enhance IFA attack detection accuracy in NDN. * An in-depth analysis of the impact of I-CIFPA on NDN stability and resource allocation is conducted by investigating key network performance indicators, including CacheHits, TimeOutInterests, and OutInterests. * The attack data are tested and analyzed for both single-feature and multi-feature scenarios, and the proposed algorithm is evaluated against other algorithms based on the AUC score. The remainder of this paper is structured as follows.