  Distributed Denial of Service (DDoS) attacks have plagued the Internet for
decades, but the basic defense approaches have not fundamentally changed.
Rather, the size and rate of growth in attacks have actually outpaced carriers'
and DDoS mitigation services' growth, calling for new solutions that can be,
partially or fully, deployed imminently and exhibit effectiveness. In this
paper, we examine the basic functions in Named Data Networking (NDN), a newly
proposed Internet architecture, that can address the principle weaknesses in
today's IP networks. We demonstrate by a new DDoS mitigation solution over NDN,
Fine-grained Interest Traffic Throttling FITT, that NDN's architectural
changes, even when incrementally deployed, can make DDoS attacks fundamentally
more difficult to launch and less effective. FITT leverages the NDN design to
enable the network to detect DDoS from victim's feedback, throttles DDoS
traffic by reverse its exact paths through the network, and enforces control
over the misbehaving entities at their sources. Our extensive simulation
results show that FITT can throttle attack traffic with one-way time delay from
the victim to the NDN gateway; upon activation, FITT effectively stop attack
traffic from impacting benign flows, resulting in over 99\% of packets reaching
victims being legitimate ones. We further demonstrate that service providers
may implement NDN/FITT on existing CDN nodes as an incrementally deployable
solution to effectuate the application level remediation at the sources, which
remains unattainable in today's DDoS mitigation approaches.
