on the interdomain routing protocol BGP can have dire implications for victim networks. For example, the prefix-hijacking attack injects and propagates false routes to the Internet, causing victim's traffic to be redirected to the attacker networks for sniffing, modification, or dropping [91]. Traffic sniffing and modification are very difficult to detect and mitigate, and create huge security and privacy issues for the victim, while blackholing severely affects online businesses and critical infrastructures. 4.5 SDN Security Attack Prevention Many solutions have been proposed to detect and mitigate indi- vidual attacks. For example, in DDoS realm, many victim-deployed or ISP-deployed DDoS defenses, overlay-based DDoS defenses [92], and content replication to sustain high-volume attacks have been proposed and deployed. In routing realm, detection approaches that monitor live BGP data feeds and conduct data plane probing have been proposed to diagnose prefix-hijacking attacks. But ultimately, traffic flows, attacks, and their routes are the results of actions of multiple networks, each following its individual interests and priorities. Thus, while many attack instances can be handled by the victim and its local ISP, there will always exist attacks that cannot be diagnosed or mitigated without help from remote networks, which are involved in sourcing or carrying traffic to the victim. Today's Internet lacks such wide-scale, general service for automated inter-ISP collab- oration on security problem diagnosis and mitigation. There have been numerous research works on inter-ISP collabora- tion for attack diagnosis and mitigation, such as collaborative DDoS defenses, (Defense-by-Offense, Internet traceback [93], pushback [94], DefCOM [95]), collaborative spoofing defenses (Packet Pass- ports [96], Hash-based traceback [93], core-based traffic filtering) collaborative worm defenses, and collaborative routing defenses. However, most proposals are still not deployed today because (1) most of the proposals only focus on d