UDP Probe Port Mapping for Spoofed Response Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious actors often send spoofed UDP packets with false source addresses, which complicates verification and increases computational burden in network scanning.
Innovation Solution
A method involving the generation of probe UDP packets with ephemeral source port numbers and lossy hash functions to distinguish between legitimate and spoofed packets, reducing computational resources by filtering out spoofed packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If UDP packets are processed without verification, then processing speed is maintained, but accuracy of network scanning deteriorates due to spoofed packets
Solution Approach 1:
The system performs preliminary actions by generating probe packets with unique ephemeral port numbers and hash values before actual scanning. These pre-generated identifiers are used to verify the legitimacy of response packets, allowing the system to quickly filter spoofed packets without detailed analysis, thus maintaining processing speed while improving accuracy.
Solution Approach 2:
The patent introduces hash values as an intermediary mechanism. The hash is generated from the destination and local addresses and embedded in the probe packet. This intermediary element enables quick verification of packet legitimacy by comparing hash values, allowing the system to distinguish genuine responses from spoofed packets without complex analysis, thereby resolving the contradiction between processing speed and scanning accuracy.
2Measurement precision
If all UDP packets are processed in detail, then accuracy is improved, but computational resources are wasted on spoofed packets
Solution Approach 1:
The system extracts and processes only the critical verification elements (ephemeral port numbers and hash values) from UDP packets. By focusing solely on these specific fields rather than analyzing entire packets, the system achieves accurate verification of packet legitimacy while minimizing computational resource consumption on spoofed packets.
Solution Approach 2:
The patent changes the verification parameter from comprehensive packet analysis to simple hash value comparison. By transforming the verification process into a straightforward parameter comparison (matching ephemeral port numbers and hash values), the system achieves high accuracy in identifying spoofed packets with minimal computational overhead, effectively reducing energy loss.
3Reliability
If spoofed packets are not filtered, then device complexity is reduced, but reliability of network scanning deteriorates
Solution Approach 1:
The system creates simplified copies of the verification mechanism by generating probe packets with predetermined ephemeral port numbers and hash values. Instead of implementing complex filtering logic, the system simply compares incoming packets against these pre-generated identifiers, achieving high reliability in spoofed packet detection while keeping the filtering mechanism simple and straightforward.
Data Source
AI summary
The ephemeral port of a probe UDP packet is populated with a first value that is a function of the destination address and destination port of a target as well as a random seed. The first value may also be a function of the local address of the server generating the probe UDP packet. The destination port of a response UDP packet is compared to a second value that is a function of the source address, source port, and the random seed, and possibly the destination address. If the destination port matches the second value, the response packet is determined not to be spoofed. Probe packets may be generated by multiple probes and labeled with a local address and index assigned to the probe to enable response packets to be mapped back to a probe.