Attack Resilience of Cache Replacement Policies: A Study Based on TTL Approximation

Tian Xie, Namitha Nambiar, Ting He, Patrick McDaniel

Research output: Contribution to journalArticlepeer-review

1 Scopus citations


Caches are pervasively used in communication networks to speed up content access by reusing previous communications, where various replacement policies are used to manage the cached contents. The replacement policy of a cache plays a key role in its performance, and is thus extensively engineered to achieve a high hit ratio in benign environments. However, some studies showed that a policy with a higher hit ratio in benign environments may be more vulnerable to cache pollution attacks that intentionally send requests for unpopular contents. To understand the cache performance under such attacks, we analyze a suite of representative replacement policies under the framework of TTL approximation in how well they preserve the hit ratios for legitimate users, while incorporating the delay for the cache to obtain a missing content. We further develop a scheme to adapt the cache replacement policy based on the perceived level of attack. Our analysis and validation on real traces show that although no single policy is resilient to all the attack strategies, suitably adapting the replacement policy can notably improve the attack resilience of the cache. Motivated by these results, we implement selected policies as well as policy adaptation in an open-source SDN switch to manage flow rule replacement, which is shown to notably improve its resilience to pollution attacks.

Original languageEnglish (US)
Pages (from-to)2433-2447
Number of pages15
JournalIEEE/ACM Transactions on Networking
Issue number6
StatePublished - Dec 1 2022

All Science Journal Classification (ASJC) codes

  • Software
  • Computer Science Applications
  • Computer Networks and Communications
  • Electrical and Electronic Engineering


Dive into the research topics of 'Attack Resilience of Cache Replacement Policies: A Study Based on TTL Approximation'. Together they form a unique fingerprint.

Cite this