NetHide: Secure and Practical Network Topology Obfuscation

on YouTube ↗24m

" summary

NetHide formulates topology obfuscation as a multi-objective optimization, samples forwarding behaviors, and implements the dataplane logic in P4 to intercept and rewrite traceroute probes in a stateless, line-rate way. It obfuscates a 150‑node topology while still allowing operators to trace back 90% of link failures; at 80% flow‑density reduction it leaves 82% of paths unmodified. The system is fully implemented, deploys virtual paths on the real network, and significantly raises the cost of link‑flooding attacks while keeping debugging usable.

AI-written summary · about

" chapters (14)

1. 0:00Intro
2. 0:49Link flooding attacks (LFA) target the infrastructure
3. 4:16Learning large topologies by combining many path measurements
4. 6:45Reactive and proactive strategies to mitigate link-flooding attacks
5. 7:53Topology obfuscation as an optimization problem
6. 8:38A topology is robust against LFAS if the flow density of each link does not exceed is capacity
7. 9:07Two basic strategies for attacking the virtual topology despite obfuscation
8. 10:05Accuracy and utility measure the closeness of P and V
9. 11:34NetHide optimizes over a random sample of solutions to improve performance and security
10. 13:02Maintaining the utility of debugging tools requires sending packets through the actual network
11. 14:13Programmable network devices allow modifying tracing packets at line rate
12. 15:41Encoding state in packets instead of storing it in devices
13. 18:07High protection with small impact on accuracy and utility
14. 19:10NetHide: Secure and Practical Network Topology Obfuscation

" related talks

• 19mDefending against Traffic Analysis Attacks with Flexible In-Network ObfuscationMingwei Xu, Qing Li, Yong Jiang, Gianni Antichi, Guorui Xie, Zhenning Shi, Yijia Zhu, Kejun Li, Changxing Weng, Sebastiano Miano · NSDI '26
• 17mNetHint: White-Box Networking for Multi-Tenant Data CentersWei Zhang, Ion Stoica, Jingrong Chen, Danyang Zhuo, Hong Zhang, Liang Luo, Jeffrey Chase · 19th USENIX Symposium on Networked Systems Design and Implementation (NSDI '22)
• 17mTopoOpt: Co-optimizing Network Topology and Parallelization Strategy for Distributed...Ying Zhang, Zhihao Jia, Manya Ghobadi, Dheevatsa Mudigere, Weiyang Wang, Moein Khazraee, Zhizhen Zhong, Anthony Kewitsch · NSDI 2023
• 20mContra: A Programmable System for Performance aware RoutingDavid Walker, Ryan Beckett, Kuo-Feng Hsu, Ang Chen, Jennifer Rexford, Praveen Tammana · NSDI 2020
• 30mYou See Honey, I See Beehive: Developing Honey NetworksJoseph Muniz · RSAC 2020 Asia Pacific & Japan
• 11mTurbo Tunnel, a good way to design censorship circumvention protocolsDavid Fifield · FOCI '20
• 13mEfficient Navigation for Modern NetworksRitesh Mukherjee · Network to Code Networking Summit at Interop 2019
• 15mOn Design and Enhancement of Smart Grid Honeypot System for Practical Collection...Wei Lin, Daisuke Mashima, Derek Kok, Muhammad Hazwan, Alvin Cheng · 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET '20)