# XGBoost-Based Detection of DDoS Attacks in Named Data Networking
## 2 Related Work  
With the gradual development of the NDN architecture, the research on attack models and security for NDN networks has become an important direction in the field of network security mechanisms. NDN can improve the efficiency of data transmission through content-based naming and decentralized design, but at the same time, it also exposes some unique security risks, such as interest packet flooding attacks and cache pollution attacks. Research on these attack models and detection and defense methods has gradually become a hot research direction in the field of NDN network security. Several approaches have been proposed to detect IFA in NDN. One early method relies on satisfaction-based detection [3], where nodes monitor the ratio of satisfied interests to identify abnormal behavior. The SBPB method identifies IFA by determining whether the satisfaction level of a node falls below a predefined threshold. However, this method is limited to simple, static attack models and assumes that interest packets do not comply with caching and forwarding policies, which may lead to excessive penalties for independent decisions and insufficient ability to deal with complex scenarios such as collusion and hybrid attacks. The Poseidon detection and defense framework [9] is proposed to respond to and mitigate attacks in real time, which responds to detection through threshold settings in local algorithms and mitigates attacks via a push-back mechanism. Fixed thresholds may prevent the system from adapting to various attack patterns, and since it is deployed at routing nodes, it is relatively dependent on the network topology. A method based on Random Forest [10] is used for detecting IFA attacks. This method identifies malicious prefixes among abnormal prefixes based on the number of PIT (Pending Interest Table) entries used. Compared with other methods, the proposed scheme could reduce the occupation of PIT. The random forest algorithm uses the ensemble learning method of Bagging [11], which can lead to issues such as long training time and instability when dealing with large-scale datasets. These methods have demonstrated certain effectiveness in identifying and mitigating high-intensity IFA attacks, but low-rate attacks can hide within normal traffic and do not produce specific indicators, making it difficult to judge whether an attack is occurring based on threshold-based approaches. It is challenging to address new models of IFA attacks using these methods. With the development of Named Data Networking, the forms of Denial-of-Service (DoS) attacks have been continuously evolving. [PERSON] et al. were the first to propose a novel type of DoS attack, the CIFA, which is characterized by its high level of stealth, making traditional detection methods ineffective [6]. CIFA employs multiple attackers working in coordination, sending carefully crafted Interest packets at a low rate while mimicking normal communication patterns, thereby avoiding the generation of obvious anomalous traffic features. This attack strategy surpasses the limitations of traditional Interest Flooding Attacks, making it difficult for defense mechanisms based on traffic statistics or anomaly detection to capture significant attack features. These algorithms primarily employ machine learning or other single-classification algorithms. Building on the CIFA attack, the Improved CIFA (I-CIFA) is proposed [7] and further, the hybrid combined version is introduced through I-CIFA with CPA [8]. This attack not only inherits the stealth characteristics of CIFA and enhances its attack intensity, making it more effective in depleting network resources and impacting data forwarding performance, but also exacerbates the threat of CPA attacks on caching. Currently, no defense mechanisms have been proposed against the hybrid attack of I-CIFA and CPA. Existing detection methods often fail to capture the temporal and spatial correlation between malicious interests, making them unsuitable for identifying the low-rate, distributed patterns of CIFA [12; 13].