Faas: Filtering Ip Spoofing Traffic As A Service

Bingyang Liu,Jun Bi,Xiaowei Yang

DOI: https://doi.org/10.1145/2377677.2377707

IF: 1.937

2012-01-01

ACM SIGCOMM Computer Communication Review

Abstract:No abstract available.

What problem does this paper attempt to address?

Filtering Spoofed IP Traffic Using Switching ASICs

Jiasong Bai,Jun Bi,Menghao Zhang,Guanyu Li

DOI: https://doi.org/10.1145/3234200.3234205

2018-01-01

Abstract:short-paper Free Access Share on Filtering Spoofed IP Traffic Using Switching ASICs Authors: Jiasong Bai Institute for Network Sciences and Cyberspace, Tsinghua University, Department of Computer Science and Technology, Tsinghua University, Beijing National Research Center for Information Science and Technology (BNRist) Institute for Network Sciences and Cyberspace, Tsinghua University, Department of Computer Science and Technology, Tsinghua University, Beijing National Research Center for Information Science and Technology (BNRist)View Profile , Jun Bi Institute for Network Sciences and Cyberspace, Tsinghua University, Department of Computer Science and Technology, Tsinghua University, Beijing National Research Center for Information Science and Technology (BNRist) Institute for Network Sciences and Cyberspace, Tsinghua University, Department of Computer Science and Technology, Tsinghua University, Beijing National Research Center for Information Science and Technology (BNRist)View Profile , Menghao Zhang Institute for Network Sciences and Cyberspace, Tsinghua University, Department of Computer Science and Technology, Tsinghua University, Beijing National Research Center for Information Science and Technology (BNRist) Institute for Network Sciences and Cyberspace, Tsinghua University, Department of Computer Science and Technology, Tsinghua University, Beijing National Research Center for Information Science and Technology (BNRist)View Profile , Guanyu Li Institute for Network Sciences and Cyberspace, Tsinghua University, Department of Computer Science and Technology, Tsinghua University, Beijing National Research Center for Information Science and Technology (BNRist) Institute for Network Sciences and Cyberspace, Tsinghua University, Department of Computer Science and Technology, Tsinghua University, Beijing National Research Center for Information Science and Technology (BNRist)View Profile Authors Info & Claims SIGCOMM '18: Proceedings of the ACM SIGCOMM 2018 Conference on Posters and DemosAugust 2018 Pages 51–53https://doi.org/10.1145/3234200.3234205Published:07 August 2018Publication History 6citation452DownloadsMetricsTotal Citations6Total Downloads452Last 12 Months95Last 6 weeks25 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF
VASE: Filtering IP spoofing traffic with agility

Guang Yao,Jun Bi,Peiyao Xiao

DOI: https://doi.org/10.1016/j.comnet.2012.08.018

IF: 5.493

2013-01-01

Computer Networks

Abstract:Filtering out traffic with forged source address on routers can significantly improve the security of Internet. However, despite intermittent IP spoofing attacks, existing filtering mechanisms inspect each packet all the time, consuming considerable resource on routers even there is no spoofing at all. This article considers the requirement for a solution performing IP spoofing filtering with agility, which consumes resource in proportional to the size of attack. A novel IP spoofing filtering mechanism named Virtual Anti-Spoofing Edge (VASE) is proposed in this article. VASE uses sampling and on-demand filter configuration to reduce unnecessary overhead in peace time. The evaluation based on simulation shows VASE has obvious advantages over commonly used mechanisms in various scenarios. VASE is fully compatible with current IP spoofing filtering practices and can be implemented with commodity routers. In the campus network of Tsinghua University, VASE is providing real benefits.
Performing software defined route-based IP spoofing filtering with SEFA

Guang Yao,Jun Bi,Tao Feng,Peiyao Xiao,Duanqi Zhou

DOI: https://doi.org/10.1109/ICCCN.2014.6911784

2014-01-01

Abstract:IP spoofing is a well-known security threat on the Internet. Though there have been a number of spoofing prevention mechanisms, due the diversity of networks and management objectives, the operators may prefer a framework which enables easy installation and modification of the IP spoofing prevention solution, rather than a single mechanism. In this article, a lightweight and efficient framework for route-based IP spoofing filtering, named SEFA, is proposed. Through providing a collective view of the network and decoupling the filtering rule generation from network devices, SEFA enables easily installation of spoofing filtering application. SEFA mainly resolves the challenge that how to build network abstraction without taking full controllability. SEFA has been implemented based on slightly modifying commercial routers and an open source controller. Based on experiments, SEFA is found to be able to reduce the overhead and the latency of filtering rule generation and installation, while keeping off the complexity and latency of generating forwarding rules by the controller.
Address Protection-as-a-Service An inter-AS Framework for IP Spoofing Resilience

YiHao Jia,Ying Liu,Gang Ren

DOI: https://doi.org/10.1109/GLOBECOM38437.2019.9013151

2019-01-01

Abstract:IP spoofing, which is generally used for anonymity and amplification, constantly leads to pervasive distributed denial-of-service (DDoS) attacks. To mitigate IP spoofing, source address validation is divided into access network, intra-autonomous system (AS), and inter-AS levels. However, because of ambiguous incentives, heterogeneous demands, and fragile trust, techniques for the inter-AS level fail in practice, and thus, IP spoofing is still considered as an almost open vulnerability of the entire Internet. In this study, we aim to transform the inter-AS source address validation into an "address protection" service, and we mitigate IP spoofing through an economicsdriven framework - apf ('a'ddress 'p'rotection 'f'ramework). In such a protection, the addresses belonging to one AS can be prevented from being spoofed by others. Behind the framework, such a service will be consolidated by a unified trust anchor with a uniform interface, and deployer ASes will be free to select their preferred techniques and invoke the service when needed. Based on the empirical data and theoretical analysis, we prove that the service is acceptable for triggering economics-driven implementation under the guidance of the apf framework.
Detecting SYN Flooding Agents under Any Type of IP Spoofing

Dalia Nashat,Xiaohong Jiang,Susumu Horiguchi

DOI: https://doi.org/10.1109/icebe.2008.18

2008-01-01

Abstract:The TCP SYN flooding attack is the most prevalent type of DDoS attacks that exhaust network resources. A router based detection scheme has been proposed to detect the SYN flooding agents based on the assumption that the SYN packets from the agent and the SYN/ACK packets from the victimpsilas server pass through different leaf routers. In the current IP spoofing techniques, however, the attacker can spoof a random address from any subnetwork, so the SYN packets from the agent and the SYN/ACK packets from the server may pass through the same leaf router. Therefore, a more general and flexible detection scheme is highly desirable for the efficient detection of these flooding agents under any type of IP spoofing. In this paper, we propose such a scheme to detect the flooding agents by considering all the possible kinds of IP spoofing. The proposed scheme is based on the TCP SYN-SYN/ACK protocol pair with the consideration of packet header information (both sequence and Ack. numbers). The Counting Bloom Filter is used to classify all the incoming SYN/ACK packets to the sub network into two streams, the first SYN/ACK packets (SYN/ACKf ) and the retransmission SYN/ACK packets (SYN/ACKr), to make our scheme generally applicable and the Cumulative Sum algorithm is applied to avoid the dependence of detection on sites and access patterns. Compared to the old detection scheme without the consideration of IP spoofing techniques, the proposed new scheme can significantly improve the accuracy in detecting the SYN flooding agents, as verified by extensive simulation results based on different IP spoofing techniques.
MASK:An Efficient Mechanism to Extend Inter-Domain IP Spoofing Preventions

Lu Xi

2008-01-01

Abstract:IP spoofing hinders the efficiency of DDoS defenses. While recent proposals of IP spoofing prevention mechanisms are weak at filtering spoofing packets due to the complexity in maintaining source IP spaces and the low incentive of deployments. To address this problem,we propose an efficient mechanism to extend the range of inter-domain IP spoofing prevention called MASK. Source MASK nodes inform destination MASK nodes about the source IP spaces and labels of their neighbor Stub-ASes in order to implement the marking and verification of packets towards the Stub-ASes,and limit the number of MASK peers through the propagation of BGP updates so as to reduce the overheads of computing and storing of labels. By utilizing the method of extending the spoofing prevention to Stub-ASes,MASK can not only enlarge the domain of the spoofing prevention service,but also filter spoofing packets in advance. Through analysis and simulations,we demonstrate MASK's accuracy and effectiveness.
An inter-AS path vector filter: towards elimination of false negatives

Zhou Zhang,Ying Liu,Jianping Wu,Gang Ren,Jun Bi

DOI: https://doi.org/10.1109/LANMAN.2015.7114734

2015-01-01

Abstract:IP spoofing based attacks remains a serious and open security problem due to the fact that the current Internet implements no source address authentication mechanisms. A series of anti-spoofing practices have long been proposed while their actual implementation seems far from satisfactory. Route based filters were extensively studied in the design of Inter-AS source address validation methods. Traditional route based filters only use route direction information to establish filtering rules, causing inherited fake negatives. A novel inter-AS filter based on route path vector is proposed to reduce or even eliminate such fake negatives in this article. We name the filter IPVF (Inter-AS Path Vector Filter), which utilizes the route information of both path and distance, exhibits measurable increase in performance and incurs acceptable additional bandwidth cost. Moreover, traditional route based filtering rules is easy to be deduced by attackers. Since the filtering rules of IPVF could change over time by setting parameters, its actual improvement in performance could be exponentially increased.
LAS: An effective anti-spoofing method using existing information

Baobao Zhang,Jun Bi,Jianping Wu

DOI: https://doi.org/10.1109/ICCCN.2014.6911764

2014-01-01

Abstract:In today's Internet, users can send packets with forged source IP addresses, called IP Spoofing, which causes many severe problems to the Internet, especially the security problem. Extensive methods have been proposed to prevent IP spoofing. One category of anti-spoofing methods is extra-information-based. The other category of anti-spoofing methods is existing-information-based. The existing-information-based anti-spoofing methods are much easier to deploy than the extra-information-based ones. Thus, we focus on the existing-information-based anti-spoofing methods in this paper. However, the existing existing-information-based anti-spoofing methods perform poorly on preventing IP spoofing. Therefore, in this paper we propose a new existing-information-based anti-spoofing method, named Link-state-based Anti-Spoofing (LAS), which works in a link-state-protocol-based network. LAS provides good effectiveness on preventing IP spoofing as our simulation results show that even if LAS is only deployed on 10% of routers in a link-state-protocol-based network, 80%~99% of spoofing cases in the network can be prevented in general.
A Backscatter Technology Based Study on Source Address Spoofing

LI Pei-Guo,BI Jun,ZHOU Zi-Jian

2008-01-01

Periodical of Ocean University of China

Abstract:Source address spoofing has become a widely used mechanism to achieve attack because it is easy to launch and difficult to detect and trace.Source address spoofing attacks pose a significant threat to the Internet today.Network security is facing a severe challenge we have never met before.It is an important task to research source address spoofing attacks.This paper surveys the definition of source address spoofing attacks,explains the principles of Backscatter and ICMP techniques,and analyzes the newest Backscatter data captured by CAIDA network telescopes from the macro and micro views.The traffic of ICMP packets is extracted and gathered by advanced data mining and statistical analysis techniques.The distribution of attacked ports by source address spoofing is given according to the ICMP packet.Some major attacked services are analyzed in detail and new methods of DoS/DDoS by means of spoofing are also explored,including their hazards.Finally,the source address spoofing attacks situation on the Internet and future work are discussed to conclude the article.
A Distributed IP Spoof Detection System in Intranet

Guanding Yu

2005-01-01

Abstract:A distributed IP spoof detection system in Intranet is proposed, which can efficiently detect IP spoof behaviors in Intranet. Current techniques of defending IP spoof are analyzed. Aimed at characteristics of Intranet, the design of the system is introduced in detail. The determination method of IP spoof and the design of the monitor, which is a key component of the system, are presented. The implementation of data capture model is also presented. From the experimentation result, it is concluded that the system has the characteristics of high accuracy and real-time performance, but little data traffic. It can be generalized in Intranet of different scales and in other network security systems.
NetHCF: Filtering Spoofed IP Traffic with Programmable Switches

Menghao Zhang,Guanyu Li,Xiao Kong,Chang Liu,Mingwei Xu,Guofei Gu,Jianping Wu

DOI: https://doi.org/10.1109/tdsc.2022.3161015

2022-01-01

IEEE Transactions on Dependable and Secure Computing

Abstract:In this paper, we identify the opportunity of using programmable switches to improve the state of the art in spoofed IP traffic filtering, and propose NetHCF , a line-rate in-network system to filter spoofed traffic. One key challenge in the design of NetHCF is to handle the restrictions stemmed from the limited computational model and memory resources of programmable switches. We address this by decomposing the HCF scheme into two complementary parts, by aggregating the IP-to-Hop-Count (IP2HC) mapping table for efficient memory usage, and by designing adaptive mechanisms to handle routing changes, IP popularity changes, and network activity dynamics. We implement an open-source prototype of NetHCF , and conduct extensive evaluations. The evaluation results demonstrate that NetHCF is able to process most legitimate traffic in 1 $\mu$ s, filter spoofed IP traffic effectively under network dynamics, with less than 30% of switch resource occupation.
NETHCF: Enabling Line-rate and Adaptive Spoofed IP Traffic Filtering

Guanyu Li,Menghao Zhang,Chang Liu,Xiao Kong,Ang Chen,Guofei Gu,Haixin Duan

DOI: https://doi.org/10.1109/icnp.2019.8888057

2019-01-01

Abstract:In this paper, we design NETHCF, a line-rate in-network system for filtering spoofed traffic. NETHCF leverages the opportunity provided by programmable switches to design a novel defense against spoofed IP traffic, and it is highly efficient and adaptive. One key challenge stems from the restrictions of the computational model and memory resources of programmable switches. We address this by decomposing the HCF system into two complementary components-one component for the data plane and another for the control plane. We also aggregate the IP-to-Hop-Count (IP2HC) mapping table for efficient memory usage, and design adaptive mechanisms to handle end-to-end routing changes, IP popularity changes, and network activity dynamics. We have built a prototype on a hardware Tofino switch, and our evaluation demonstrates that NETHCF can achieve line-rate and adaptive traffic filtering with low overheads.
Revisiting Inter-As IP Spoofing Let the Protection Drive Source Address Validation.

Yihao Jia,Ying Liu,Gang Ren,Lin He

DOI: https://doi.org/10.1109/pccc.2017.8280451

2017-01-01

Abstract:IP spoofing, which is prevalently used for anonymity and reflection attacks, has shown increasing destructive power in recent years. Although certain source address validation solutions have been standardized by the Internet Engineering Task Force, few networks are willing to adopt them in view of the deficiency of deployment benefits. Actually, all the source address validation solutions face the problem of a lack of deployability. In this paper, we summarize the key points describing deployability and propose a new security service-inter-autonomous-system (AS) Source Address Protection (iSAP). Technically, by increasing the possibility of keeping the source address belonging to one AS from being the victim of reflection flooding, iSAP improves the deployers ability to prevent IP spoofing and increases incremental deployability. In reality, such a service can also be regarded as a new profit opportunity for ASes and it could progress gradually once it is well commercialized. Based on simulations with real Internet topology data, the results illustrate that iSAP can protect ASes from being reflected with only a few deployers, exhibiting a high potential to mitigate reflection flooding with modest resource consumption.
Random Spoofed Source Address Distributed Denial-of-Service Attack Traffic Filter

XIAO Jun,YUN Xiao-Chun,ZHANG Yong-Zheng

DOI: https://doi.org/10.3724/sp.j.1001.2011.03882

2011-01-01

Journal of Software

Abstract:Distributed Denial-of-Service(DDoS) attack,using random spoofed source addresses,is popular because it can protect the attacker's anonymity. It is very difficult to defent against this attack because it is very hard to differentiate bad traffic from the normal. In this paper,based on the source addresses distribution statistical feature,an effective defense scheme,which can differentiate vicious traffic from normal traffic,is presented. Based on a novel Extended Counting Bloom Filter(ECBF) data structure,this paper proposes an algorithm to identify normal addresses accurately. Once a normal address is sought out,packets from it will be forwarded with high priority,thus,normal traffic is protected. The simulation results show that this scheme can identify legitimate addresses accurately,protect legitimate traffic effectively,and give better protection to valuable long flows. Because the time complexity of the method is O(1) ,and it needs several MB memory space,it can be implemented in edge routers or network secure devices like firewalls to defend against random spoofed source address DDoS attacks.
Investigating the efficiency of fine granularity source address validation in IPv6 networks

Fuliang Li,Changqing An,Jiahai Yang,Ning Jiang,Jianping Wu

DOI: https://doi.org/10.1109/APNOMS.2011.6077038

2011-01-01

Abstract:IPv6 protocol has been widely deployed in the world. As the IANA pool of IPv4 addresses has run out, IPv6 will become increasingly important. Although the IPv6 protocol stack presents considerable advantages compared with the IPv4 protocol stack, IP source address spoofing is still exploited in IPv6 to initiate malicious attacks. Some techniques are proposed and deployed to implement source address validation at fine granularity. In this paper, we investigate the efficiency of fine granularity IP source address validation, e.g. whether filtering technology is deployed to prevent hosts from using forged IP address. We develop a detection tool with controlled spoofing ability which can infer whether the function of filtering spoofing address packets is enabled. We run this tool in 12 famous universities in China and collect the testing data. We gather a total of 41373 probes from 324 clients, and each probe includes sending at least 5 packets with the same spoofing source address to the control server. Results reveal that, 77.02% of the spoofing probes are completely filtered, 0.29% of the spoofing probes are partly filtered and the rest spoofing probes are not filtered at all. Overall, this illustrates that techniques of source address validation have been widely deployed in campus networks. Our statistical results provide practical basis for the deployment and further development of source address validation protocols in IPv6 networks.
On the Deployability of Inter-As Spoofing Defenses

Bingyang Liu,Jun Bi,Yu Zhu

DOI: https://doi.org/10.1109/mnet.2015.7113230

IF: 10.294

2015-01-01

IEEE Network

Abstract:IP spoofing makes network attacks more destructive and harder to prevent. AS spoofing defenses mitigate these attacks by enforcing AS-level source address validity. Although many inter-AS defenses have been proposed, none is sufficiently deployed by Internet service providers. In this article we investigate the deployability of the defenses by evaluating their deployment benefit, deployment cost, and operational risk. Evaluation results reveal the technical features of highly deployable defenses, which can help improve existing defenses and the design of future defenses.
SMap: Internet-wide Scanning for Spoofing

Tianxiang Dai,Haya Shulman

DOI: https://doi.org/10.1145/3485832.3485917

2024-04-16

Abstract:To protect themselves from attacks, networks need to enforce ingress filtering, i.e., block inbound packets sent from spoofed IP addresses. Although this is a widely known best practice, it is still not clear how many networks do not block spoofed packets. Inferring the extent of spoofability at Internet scale is challenging and despite multiple efforts the existing studies currently cover only a limited set of the Internet networks: they can either measure networks that operate servers with faulty network-stack implementations, or require installation of the measurement software on volunteer networks, or assume specific properties, like traceroute loops. Improving coverage of the spoofing measurements is critical. In this work we present the Spoofing Mapper (SMap): the first scanner for performing Internet-wide studies of ingress filtering. SMap evaluates spoofability of networks utilising standard protocols that are present in almost any Internet network. We applied SMap for Internet-wide measurements of ingress filtering: we found that 69.8% of all the Autonomous Systems (ASes) in the Internet do not filter spoofed packets and found 46880 new spoofable ASes which were not identified in prior studies. Our measurements with SMap provide the first comprehensive view of ingress filtering deployment in the Internet as well as remediation in filtering spoofed packets over a period of two years until May 2021. We set up a web service at <a class="link-external link-https" href="https://smap.cad.sit.fraunhofer.de" rel="external noopener nofollow">this https URL</a> to perform continual Internet-wide data collection with SMap and display statistics from spoofing evaluation. We make our datasets as well as the SMap (implementation and the source code) publicly available to enable researchers to reproduce and validate our results, as well as to continually keep track of changes in filtering spoofed packets in the Internet.

Cryptography and Security
An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

Lizhong Xie,Jun Bi,Jianpin Wu

DOI: https://doi.org/10.1007/978-3-540-72590-9_121

2007-01-01

Abstract:In today's Internet routing architecture, the router doesn't validate the correctness of the source address carried in the packet, nor keep the state information when forwarding the packet. Thus the DDoS attacks with spoofed IP source address can cause security problems. In this paper, we aim to prevent the attackers from attacking somewhere outside the IPv6 edge network with forged source address in the fine granularity. The proposed methods include source address authentication by using session key and hash digest algorithm, and replay attack prevention by combining the sequence number method and the timestamp method. This paper presents the algorithm design and evaluates its feasibility and correctness by simulation experiments.
A Multi-fence Countermeasure Based Inter-domain Source Address Validation Method

Jie Li,Jun Bi,Jianping Wu,Wei Zhang

DOI: https://doi.org/10.1109/nca.2012.20

2012-01-01

Abstract:The functional deficiency of the Internet architecture enables attackers the ability to easily to spoof IP source address. The traditional signature-and-verification based anti-spoofing methods are often limited by essential process based on an explicit analysis and process of the IP header and does not adapt to incremental deployment. This paper designs a multi-fence countermeasure based inter-domain source address validation method named VIP. By employing intelligent originating information label and extended MPLS based cloud and network, VIP enables lightweight-label-based packet forwarding and validation. And VIP offers gains in efficiency by reducing the load on both forwarding tables and validation processing without negative influences and complex operations on de facto networks. In addition to enhanced scalability, VIP may facilitate incremental deployment in the long run.
Toward Incentivizing Anti-Spoofing Deployment

Bingyang Liu,Jun Bi,Athanasios V. Vasilakos

DOI: https://doi.org/10.1109/tifs.2013.2296437

IF: 7.231

2014-01-01

IEEE Transactions on Information Forensics and Security

Abstract:IP spoofing-based flooding attacks are a serious and open security problem on the current Internet. The best current antispoofing practices have long been implemented in modern routers. However, they are not sufficiently applied due to the lack of deployment incentives, i.e., an autonomous system (AS) can hardly gain additional protection by deploying them. In this paper, we propose mutual egress filtering (MEF), a novel antispoofing method, which provides continuous deployment incentives. The MEF is implemented on the AS border routers using access control lists (ACLs). It drops an outbound packet whose source address does not belong to the local AS if the packet is related to a spoofing attack against other MEF-enabled ASes. By this means, only the deployers of the MEF can gain protection, whereas nondeployers cannot free ride. As more ASes deploy MEF, deployment incentives become higher. We present the system design of MEF, and propose an optimal prefix compression algorithm to compact the ACL into the routers' limited hardware resource. With theoretical analysis and simulations with real Internet data, our evaluation results show that MEF is the only method that achieves monotonically increasing deployment incentives for all types of spoofing attacks, and the system design is lightweight and practical. The prefix compression algorithm advances the state-of-the-art by generalizing the functionalities and reducing the overhead in both time and space.

Faas: Filtering Ip Spoofing Traffic As A Service

Filtering Spoofed IP Traffic Using Switching ASICs

VASE: Filtering IP spoofing traffic with agility

Performing software defined route-based IP spoofing filtering with SEFA

Address Protection-as-a-Service An inter-AS Framework for IP Spoofing Resilience

Detecting SYN Flooding Agents under Any Type of IP Spoofing

MASK:An Efficient Mechanism to Extend Inter-Domain IP Spoofing Preventions

An inter-AS path vector filter: towards elimination of false negatives

LAS: An effective anti-spoofing method using existing information

A Backscatter Technology Based Study on Source Address Spoofing

A Distributed IP Spoof Detection System in Intranet

NetHCF: Filtering Spoofed IP Traffic with Programmable Switches

NETHCF: Enabling Line-rate and Adaptive Spoofed IP Traffic Filtering

Revisiting Inter-As IP Spoofing Let the Protection Drive Source Address Validation.

Random Spoofed Source Address Distributed Denial-of-Service Attack Traffic Filter

Investigating the efficiency of fine granularity source address validation in IPv6 networks

On the Deployability of Inter-As Spoofing Defenses

SMap: Internet-wide Scanning for Spoofing

An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

A Multi-fence Countermeasure Based Inter-domain Source Address Validation Method

Toward Incentivizing Anti-Spoofing Deployment