How link flooding DDoS attack remain undetected?

Question

I read some explains or paper about link flooding DDoS attack, which is new relatively.

For example

• "employs legitimate, low-density flows to flood a group of selected links. Therefore, these malicious flows can hardly be distinguished by traditional schemes..." - Towards mitigating Link Flooding Attack via incremental SDN deployment
• "target the core of the Internet that can cause significant damage while remaining undetected..." - SPIFFY: Inducing Cost-Detectability Tradeoffs for Persistent Link-Flooding Attacks

I want to know how link flooding DDoS attack works, for example,

• how employs legitimate traffic? what means attack selected links? how to remain undetected? etc.

Answer 1

...I want to know how link flooding DDoS attack works...

The authors of the second paper (SPIFFY) provide two references in the first sentence of the introduction: The Coremelt Attack and The Crossfire Attack. From reading the abstract and introduction of these papers it looks like the basic idea is that a selected network path is saturated with large amounts of normal traffic. The source of this traffic is an attacker controlled botnet and the many targets are either from a botnet too or just normal public servers. Due to saturation of this link any connectivity over this link is negatively affected, i.e. a denial of service.

... how to remain undetected?

Given that this is normal traffic (i.e. HTTP or similar) between many sources and many targets it does not look like the typical DDoS which is directed against one or a few systems. Instead it looks like normal traffic and thus existing DDoS detection heuristics don't get triggered.