CIDR+TTL Traffic Profiling for Low-Overhead IP Spoofing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network attack detection systems face issues with over-blocking legitimate traffic and computational complexity, particularly in implementing IP Source Address Validation (SAV) to combat IP address spoofing-based attacks like DDoS and spoofed flooding.
Innovation Solution
A CIDR+TTL database is generated by analyzing network traffic to establish expected TTL value ranges for each CIDR block, allowing for efficient authentication of clients by comparing subsequent traffic against these ranges, reducing the need for computationally intensive authentication routines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP Source Address Validation (SAV) is implemented to combat IP address spoofing attacks, then attack detection capability is improved, but computational complexity and over-blocking of legitimate traffic increases
Solution Approach 1:
The system performs preliminary learning during an observation mode where it collects TTL values from legitimate traffic sources and stores them in a data structure indexed by CIDR blocks. This preliminary action creates a reference database that enables fast authentication decisions without requiring complex real-time analysis, thus reducing computational complexity while maintaining reliable attack detection
Solution Approach 2:
The system creates a simplified copy of traffic source characteristics by storing only TTL value ranges associated with each CIDR block in a data structure. This copying approach replaces complex authentication routines with simple lookups and comparisons, significantly reducing computational overhead while maintaining effective spoofing detection capability
2Reliability
If IP Source Address Validation (SAV) is implemented to combat IP address spoofing attacks, then attack detection capability is improved, but over-blocking of legitimate traffic increases
Solution Approach 1:
The system applies different authentication strictness to different traffic sources by maintaining a data structure that maps CIDR blocks to their observed TTL value ranges. Legitimate traffic from known sources with matching TTL values is allowed through with minimal inspection, while traffic with mismatched TTL values or from unknown sources triggers authentication routines. This localized quality approach ensures that only suspicious traffic is blocked, preventing over-blocking of legitimate traffic while maintaining reliable attack detection
Solution Approach 2:
The system uses TTL value as a key parameter to distinguish legitimate from spoofed traffic. By learning and storing the characteristic TTL value ranges for each CIDR block during normal operation, the system can dynamically adjust its authentication behavior based on whether the observed TTL matches the expected range. This parameter-based approach allows the system to tolerate normal TTL variations in legitimate traffic while detecting spoofing attempts, thereby reducing over-blocking
Data Source
AI summary
A system may detect a plurality of data packet exchanges, the plurality of data packet exchanges representing establishments of communication sessions between a server and a plurality of network devices; extract, from first information associated with the plurality of data packet exchanges, a plurality of time to live (TTL) values that correspond to the plurality of data packet exchanges; and store, responsive to extraction of the plurality of TTL values, second information that represents the plurality of TTL values in a data structure, the data structure configured to store the second information according to a Classless Inter-Domain Routing (CIDR) block that indicates a list of internet protocol (IP) addresses associated with the communications network; and responsive to a determination that a network characteristic of the monitored network traffic satisfies a condition, change operation from an observation mode to an idle mode.