's ISPs already perform for their direct customers. SENSS automates this manual process and extends it to remote customers, while securing communications against fabrication, replay, or redirec- tion. SENSS is robust in handling uncooperative participants, or direct attacks on itself. 4.5.2 SENSS Uses We now briefly discuss we can detect and mitigate a variety of DDoS and routing attacks with SENSS. 4.5.2.1 DDoS For those DDoS attacks where we can identify TCP/IP header-level signatures, we can easily use traffic filter at remote ISPs to drop the traffic close to attack sources. However, sometimes, a victim may not be able to devise a useful signature, when the attack traffic are spoofed with randomized flow fields. To detect such DDoS attacks, during peri- ods of no attack, a SENSS customer may occasionally use traffic query to SENSS ISPs for the amount of traffic they receive from their neigh- bors and route to this customer. That way the customer gains visibility into most commonly used Internet paths by its mission traffic. During a DDoS attack without signature, the SENSS customer (i.e., the victim) issues a similar traffic query. It then compares the traffic distributions 4.6 SDN Traffic Engineering before and during the attack and identifies upstream ISPs that have previously routed little traffic to the victim but now route a lot. These ISPs are likely routing mostly attack traffic, and SENSS customer issues traffic filter messages to those to mitigate the attack. We evaluated SENSS with real CDN traffic, DDoS attacks, and Internet topology, and find that with only 30 deployed ISPs, we can already eliminate 94% of the attack traffic. 4.5.2.2 Prefix Hijacking It is easy to use SENSS for the blackhole-based prefix hijacking where an attacker announces the victim's prefixes and drops the traffic. The victim uses route query to detect the bogus route and uses route demotion to reduce the false route's propagation. The interception attack is harder to detect because an attacker transparently intercepts the vic