Neural Network Spoofing Detection via TTL Distance Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches to detecting spoofed network traffic are limited, as they require complete implementation across all border routers or knowledge of hop counts to every possible source IP, making them ineffective in many scenarios.
Innovation Solution
A method that calculates the travel distance between a source and target IP address using time-to-live information, estimating expected distances through a sparse set of known source/target distances, and employing neural networks to determine if a packet's source IP is spoofed, allowing for effective spoof detection even on unknown hosts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network-based hash map mechanisms are used for spoofing detection, then detection accuracy is improved, but implementation complexity and requirement for complete border router implementation increases
Solution Approach 1:
The patent introduces an intermediary mechanism (distance estimation module) that mediates between the packet's claimed source and the destination. This module estimates the actual network distance and compares it with the claimed source distance, providing a verification layer without requiring complete implementation across all border routers. The intermediary approach maintains detection accuracy while reducing implementation complexity.
Solution Approach 2:
The system implements feedback by comparing the estimated distance (from TTL and routing information) with the claimed source distance (from packet headers). This feedback loop enables continuous verification of packet authenticity, improving detection accuracy while using only local routing tables and TTL values, thus avoiding the need for complex global implementation.
2Reliability
If host-based solutions with complete hop count knowledge are used, then spoofing detection capability is improved, but information requirements and system overhead increase
Solution Approach 1:
Instead of requiring complete hop count information to every possible source IP, the patent uses partial action by estimating distance only for the specific source-destination pair in question. The system calculates distance on-demand using TTL and available routing information, reducing information requirements while maintaining sufficient detection capability for the specific attack scenario.
Solution Approach 2:
The system performs self-service by using the TTL field already present in the packet and local routing table information to estimate distance. It does not require external databases or pre-computed hop counts for all possible sources. The destination host itself generates the distance estimate using locally available resources, reducing information requirements and system overhead.
3Productivity
If TTL-based distance calculation is used, then detection efficiency is improved, but precision in complex network topologies deteriorates
Solution Approach 1:
The patent combines multiple information sources (TTL value, routing table data, and estimated path information) to create a composite distance estimate. This composite approach compensates for the imprecision of TTL alone in complex topologies by integrating multiple indicators, thereby improving measurement precision while maintaining the efficiency of TTL-based calculation.
Solution Approach 2:
The system changes the parameter interpretation by not treating TTL as a direct distance measure but as one component of a broader distance estimation. It adjusts the estimation by considering routing table information and network topology characteristics, transforming the raw TTL value into a more accurate distance metric that accounts for complex topology variations while preserving calculation efficiency.
Data Source
AI summary
Methods and systems for mitigating a spoofing-based attack include calculating a travel distance between a source Internet Protocol (IP) address and a target IP address from a received packet based on time-to-live information from the received packet. An expected travel distance between the source IP address and the target IP address is estimated based on a sparse set of known source/target distances. It is determined that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security action is performed responsive to the determination that the received packet has a spoofed source IP address.