A First Look at the Misuse and Abuse of the IPv4 Transfer Market
A First Look at the Misuse and Abuse of the IPv4 Transfer Market
复制标题
IPv4 传输市场的误用和滥用初探
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Petros Gigis
中科院分区：
文献类型：
--
作者：
Vasileios Giotsas;Ioana Livadariu;Petros Gigis
未分配的IPv4地址的耗尽和IPv6部署的缓慢步伐已经引起了IPv4转移市场，即组织之间分配的IPv4前缀的交易。尽管RIR制定了规范IPv4传输市场的政策，但IPv4传输为恶意网络（如垃圾邮件发送者和防弹AS）提供了机会，可以通过获得“干净”的IPv4地址空间或卸载黑名单地址来绕过声誉处罚。此外，IP传输会造成前缀合法所有权的不确定性，从而导致WHOIS记录和路由通告不一致。在本文中，我们提供了第一个详细的研究如何转移IPv4前缀被滥用在野外，通过合成一系列的纵向IP黑名单，蜜罐数据，和AS信誉列表。我们的研究结果产生的证据表明，传输的IPv4地址块被恶意网络用来解决僵尸网络和欺诈性网站，与非传输地址相比，其速度要高得多，而攻击的时间表明，这些攻击是为了逃避过滤机制。
The depletion of the unallocated IPv4 addresses and the slow pace of IPv6 deployment have given rise to the IPv4 transfer market, the trading of allocated IPv4 prefixes between organizations. Despite the policies established by RIRs to regulate the IPv4 transfer market, IPv4 transfers pose an opportunity for malicious networks, such as spammers and bulletproof ASes, to bypass reputational penalties by obtaining “clean” IPv4 address space or by offloading blacklisted addresses. Additionally, IP transfers create a window of uncertainty about the legitimate ownership of prefixes, which leads to inconsistencies in WHOIS records and routing advertisements. In this paper we provide the first detailed study of how transferred IPv4 prefixes are misused in the wild, by synthesizing an array of longitudinal IP blacklists, honeypot data, and AS reputation lists. Our findings yield evidence that transferred IPv4 address blocks are used by malicious networks to address botnets and fraudulent sites in much higher rates compared to non-transferred addresses, while the timing of the attacks indicate efforts to evade filtering mechanisms.
在peeringDB中寻找超巨星
影响因子：
2.8
作者：
Böttger T
通讯作者：
Böttger T