etection or mitigation of one attack type or variant; (2) some solutions require complex changes of the data plane or new router functionality, which are difficult to achieve; and (3) some solutions do not create proper incentives for ISPs to collaborate with each other. Inspired by SDN, which provides a simple interface (flow-based rules) to facilitate the advancement of networking protocols, we pro- pose Software dEfiNed Security Service (SENSS), a generic interface for Internet attack diagnosis and mitigation. SENSS has three key features as follows: 1) Victim-oriented: The victim of a security attack has the most incentive to detect and mitigate the attacks. The victim also has the most knowledge about the problems it is experiencing, the traffic it sees, and the help it needs to diagnose and remedy problems. Our proposed service enables this victim to directly request security services from multiple remote ISPs. For security and privacy reasons, we design mechanisms for victims to only have visibility 4 Software-Defined Networks Principles and Applications (4) Control (3) Reply SENSS server (2) Query SENSS program (1) Intitiate Victim Figure 4.15 SENSS architecture. and control of their own traffic, that is, the traffic that carries either source or destination IPs from the victim's address space. 2) Simple detection/mitigation interface from an ISP: We define a simple interface for victims to request services from ISPs, such as statistics gathering, traffic filtering, rerouting, or QoS guaran- tees. The interface is both expressive to support the detection/ mitigation of a variety of attacks (e.g., prefix hijacking, DDoS), and easy to implement in today's ISPs. 3) Programmable attack detection and mitigation across ISPs: With the simple interface provided by ISPs, victims can easily program their own attack detection and mitigation solutions across ASes. As shown in Figure 4.15, a victim can first query multiple ISPs to trace back the attack, identify the best locations for remediation, and then issue comma