Information-leakage in NDN: Detecting anomalous names

Information leakage is one the main security threats in today's Internet. It can have a significant impact on companies especially by reducing profits and destroying reputations. As Named-Data Networking (NDN) is a promising alternative for the future internet, it is essential to prevent this security threat. NDN relies on a new networking paradigm based on content name. Indeed, today's users are interested in content and not location, and there is a need for a shift from a host-to-host communication paradigm to a host-to-content one. NDN content names are defined with the traditional URL format commonly used in the Internet. In this work, we propose a novel filtering technique to detect packets with malicious names. Indeed, malicious names are more likely to be generated by malwares through "Targeted Attacks" in order to leak out information from legitimate networks. The filters will be used for the NDN firewall as they cannot rely on IP address anymore. We have performed a comprehensive statistical study of URLs based on extensive crawling experiments of main Web organizations. From our experiments, we have derived filters, which were able to detect 15% of malicious names in our data set. This is an essential step towards preventing information leakage in NDN.