BGP Route-Based Traffic Profile Creation for Spoofed IP Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting spoofed IP packets in network traffic, particularly in DDoS attacks, face challenges in constructing accurate source address profiles due to the presence of spoofed packets during the training period and incomplete profiles from low traffic volumes, and fail to effectively address spoofed source IP addresses.
Innovation Solution
A novel method using publicly available routing data to infer best paths between sources and destinations, constructing source profiles by filtering observed traffic flows through AS sets associated with network monitoring points, and utilizing TCP session and destination bogon filtering to create robust profiles that can be deployed at arbitrary network monitoring points.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If source address profiles are constructed by observing traffic during a training period, then profile creation is achieved, but spoofed packets during the training period result in inaccurate profiles
Solution Approach 1:
The patent segments the profile creation process into multiple independent components: (1) collecting routing information from multiple routing information bases (RIBs) from different network vantage points, (2) validating observed source addresses against these segmented routing data sources, and (3) constructing profiles only from validated addresses. This segmentation allows the system to cross-validate routing paths and identify spoofed packets that would fail consistency checks across multiple independent routing views.
Solution Approach 2:
The patent introduces routing information bases (RIBs) as intermediary validation layers between observed traffic and profile construction. These RIBs act as mediators that provide authoritative routing information to verify whether observed source addresses are legitimate. The system uses these intermediary routing data structures to filter out spoofed packets before they contaminate the source address profiles.
2Reliability
If TCP flows with large packet numbers are used to reduce spoofing, then non-spoofed activity is identified, but attackers can generate large TCP packets with spoofed IP addresses
Solution Approach 1:
The patent introduces routing information bases (RIBs) as intermediary validation layers between observed traffic and profile construction. These RIBs act as mediators that provide authoritative routing information to verify whether observed source addresses are legitimate. The system uses these intermediary routing data structures to filter out spoofed packets before they contaminate the source address profiles.
Solution Approach 2:
The patent implements feedback mechanisms where routing information from multiple RIBs continuously validates observed traffic patterns. When traffic is observed, the system feeds this information back against the routing databases to verify legitimacy. This feedback loop ensures that even if attackers generate large volumes of spoofed TCP traffic, the routing validation feedback will identify and reject these packets as inconsistent with legitimate routing paths.
3Quantity of substance
If profiles are created using AS numbers instead of source IP addresses, then incomplete profiles from low traffic volumes are addressed, but spoofed source IP addresses are not detected
Solution Approach 1:
The patent segments the profile creation process into multiple independent components: (1) collecting routing information from multiple routing information bases (RIBs) from different network vantage points, (2) validating observed source addresses against these segmented routing data sources, and (3) constructing profiles only from validated addresses. This segmentation allows the system to cross-validate routing paths and identify spoofed packets that would fail consistency checks across multiple independent routing views.
Solution Approach 2:
The patent adds a new dimension to profile creation by incorporating multi-dimensional routing validation. Instead of relying solely on AS number aggregation, the system validates traffic across multiple routing information dimensions from different network vantage points. This dimensional approach allows the system to maintain comprehensive profile coverage while adding routing consistency checks that operate in a different validation dimension, thereby detecting spoofed packets that would otherwise pass AS-based validation.
Data Source
AI summary
An inventive system and method for creating source profiles to detect spoofed traffic comprises obtaining a routing path for data to traverse nodes using traffic profiles, each routing path comprising at least a target AS, initializing one or more AS sets with last hop ASes, enhancing the AS sets by connecting the AS sets to routers, for each enhanced AS set, filtering observed traffic flows, and using the filtered flows to associate enhanced AS sets with network monitoring points to create the source profiles. In one aspect, filtering flows comprise TCP session filtering and/or destination bogon filtering. In one aspect, the routers are border gateway protocol routers. In one aspect, the last hop ASes are one hop away from the target AS.