Spoofed IP Traffic Detection via AS Routing Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to reliably detect spoofed Internet Protocol (IP) traffic, which complicates the identification of network attack sources and shifts attention away from attackers, especially in DDoS attacks, as they disguise their source IP addresses, making detection difficult for network-based sensors.
Innovation Solution
A method and apparatus that utilize network routing information to create an unexpected pair tuple table, correlating source and destination IP address prefixes with Autonomous System (AS) numbers, allowing for the detection of spoofed IP traffic by comparing incoming packets against this table to determine if they originate from unexpected sources, generating alerts for unauthorized traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If spoofed IP packets are used by attackers, then the attackers can conceal their identity and reduce trace-back risk, but it becomes difficult to detect and identify the sources of attack traffic
Solution Approach 1:
The patent introduces an intermediary validation mechanism that checks whether the source IP address and destination IP address pairs are consistent with known routing information. Instead of directly trusting the source IP address claimed by the attacker, the system uses routing tables as an intermediary to verify if such a source-destination pair is plausible according to network topology, thereby exposing spoofed packets without requiring direct identification of the attacker's true identity
Solution Approach 2:
The patent performs preliminary validation of IP packet legitimacy by checking source-destination address pairs against pre-stored routing information before allowing packets to traverse the network. This preliminary action filters out spoofed packets early in the network path, preventing them from reaching their intended targets and reducing the effectiveness of DDoS attacks before they can cause significant harm
2Productivity
If network-based sensors are used to detect DDoS attacks, then attack traffic can be monitored, but detection is difficult since spoofing ensures that traffic volume from individual hosts appears to be low
Solution Approach 1:
The patent uses routing information as an intermediary to validate the legitimacy of traffic sources. Instead of relying solely on traffic volume analysis which is obscured by spoofing, the system checks whether the source IP address and destination IP address pairs in incoming packets are consistent with expected routing paths. This intermediary validation mechanism can identify spoofed packets even when individual host traffic volumes appear low, as the source-destination pairs will not match legitimate routing information
3Ease of operation
If IP routing is destination-based, then spoofed IP packets are delivered to the intended target in the same way as non-spoofed IP packets, but this makes it difficult to detect spoofed traffic
Solution Approach 1:
The patent performs preliminary validation of packet legitimacy by checking source-destination IP address pairs against routing information before packets are routed to their destinations. This preliminary check occurs at network entry points or boundary routers, allowing the system to identify and block spoofed packets before they enter the network core, while still maintaining simple destination-based routing for legitimate traffic
Solution Approach 2:
The patent introduces an intermediary validation layer that checks whether the claimed source IP address and destination IP address pair is consistent with known routing topology. This intermediary check does not alter the destination-based routing mechanism itself, but adds a verification step that can identify spoofed packets while allowing legitimate packets to flow through the simplified routing system unchanged
Data Source
AI summary
A method, an apparatus and a program for detecting spoofed Internet Protocol (IP) traffic directed to a network having a plurality of autonomous systems (AS) is provided. The method comprises receiving an incoming packet through an AS, the incoming packet containing a source IP address and a destination IP address, acquiring a corresponding source and destination IP address prefixes, converting the corresponding source and destination IP address prefixes into a source AS number and a destination AS number, determining if the incoming packet arrived from an unexpected source based upon the corresponding destination IP address prefix and the converted source and destination AS number using an unexpected pair tuple table generated from network routing information and generating an alert indicating that the incoming packet is not allowed to enter the network.