Lemon: Network-Wide DDoS Detection with Routing-Oblivious Per-Flow Measurement#
USENIX Security '25 (34th USENIX Security Symposium) digest Program Core pick 13–15 August 2025
Wenhao Wu et al., Institute of Computing Technology / Chinese Academy of Sciences — Core
- Why: A DDoS-detection system implemented and evaluated on real programmable switch hardware (Tofino), directly relevant to datapath/programmable-networking work, that solves a genuine correctness problem (over-counting from unpredictable routing) rather than just adding another ML classifier.
- What: Lemon, a network-wide DDoS detection system that stays accurate even when traffic routing is unpredictable and invalidates the operator's assumed network topology — a failure mode that breaks existing sketch-based measurement systems. (from abstract only)
- How: A novel "Lemon sketch" data structure in the data plane avoids over-counting and mis-allocation across measurement points; a control plane aggregates sketches for network-wide, per-flow DDoS detection and victim identification. Implemented in both software (Bmv2) and programmable hardware (Tofino) switches. (from abstract only)
- Where applicable: General DDoS-detection deployments on programmable data-plane hardware (P4/Tofino-class switches); the routing-obliviousness is specifically valuable for networks with dynamic or asymmetric routing.