Anycast Spoofed Traffic Detection via Multilateration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively detect and mitigate anycast-based spoofed traffic, which can hide attacker identities and direct traffic to victims in reflection attacks, posing challenges in identifying and addressing distributed denial-of-service (DDoS) attacks.
Innovation Solution
A system and method utilizing multilateration and hop-count profiling to detect spoofed traffic by determining hop counts of data queries across multiple anycast servers and implementing mitigating actions when queries from a single source appear on multiple servers within a predetermined time, indicating potential spoofing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anycast-based routing is used to distribute traffic across multiple servers, then service availability and load distribution are improved, but the ability to detect spoofed traffic deteriorates because multiple servers may receive traffic from the same spoofed source IP address
Solution Approach 1:
The patent introduces a new dimension for detection by measuring the time difference of arrival (TOA) of packets at different anycast servers. Instead of relying solely on IP address validation, the system uses temporal and spatial relationships across the network to detect spoofing. By adding the time dimension to the detection process, the system can identify spoofed packets that would otherwise be indistinguishable from legitimate traffic in a traditional anycast environment.
Solution Approach 2:
The patent introduces a centralized monitoring system that acts as an intermediary between anycast servers and the detection logic. This intermediary collects TOA data from multiple servers, performs the detection analysis, and coordinates mitigation actions. The intermediary consolidates the detection function, allowing individual servers to focus on service delivery while the intermediary handles the complex analysis of spoofed traffic patterns across the anycast network.
2Measurement precision
If hop count validation is performed to detect spoofed traffic, then detection accuracy is improved, but system complexity and processing overhead increase
Solution Approach 1:
The patent implements a tiered detection approach where not all packets undergo full hop count validation. Instead, the system uses TOA analysis as a first layer of detection, and only performs more complex hop count validation on packets that exhibit suspicious temporal patterns. This partial application of rigorous validation reduces overall system complexity while maintaining high detection accuracy for actually spoofed traffic.
Solution Approach 2:
The system performs preliminary TOA measurement and analysis on all incoming packets before applying more complex hop count validation. By pre-filtering traffic using the simpler TOA metric, the system identifies suspicious packets in advance, allowing subsequent detailed hop count analysis to be applied only to a reduced subset of potentially spoofed traffic, thereby reducing overall processing overhead.
3Reliability
If real-time detection and mitigation of spoofed traffic is implemented, then attack prevention capability is improved, but processing time and computational resources increase
Solution Approach 1:
The patent implements periodic sampling of packet arrival times rather than analyzing every single packet in real-time. By selecting representative samples for detailed TOA analysis and hop count validation, the system maintains effective detection capability while significantly reducing processing time and computational resource requirements. The periodic approach allows the system to stay within acceptable processing time constraints while still identifying spoofed traffic patterns.
Solution Approach 2:
The system applies full real-time detection resources only to packets that exhibit suspicious characteristics, while using lighter-weight monitoring for the majority of normal traffic. This selective application of intensive processing maintains high attack prevention capability for actually spoofed packets while avoiding the prohibitive processing overhead of applying the same level of analysis to all traffic.
Data Source
AI summary
Systems and methods for detecting spoofed traffic include determining a first hop count of a first data query from a first transmitting device to a first server, determining a second hop count of a second data query from the first transmitting device to a second server, determining a third hop count of a third data query appearing to be from the first transmitting device to the first server, and determining a fourth hop count of a fourth data query appearing to be from the first transmitting device to the second server. The third and fourth hop counts are compared to the first and second hop counts, respectively. It is determined whether the third hop count differs from the first hop count by more than a predetermined amount.