CT-ISG: Collaborative research: Enabling Routers to Detect and Filter Spoofed Traffic

0716452 Jelena MirkoviceOf Delaware0716829 Peter ReiherUCLACT-ISG：协作研究：使路由器能够检测和过滤欺骗的TrafficIP欺骗会加剧许多安全威胁。如果欺骗被消除或充分减少，防御DDoS、分布式扫描和入侵将变得更加简单和有效。尤其令人感兴趣的是欺骗防御，它既实用(部署和操作成本低)，又有效(在稀疏部署中提供显著好处)。本项目开发了两种这样的防御机制：(1)Clouseau，它使非对称路径上的路由器能够准确地推断路由描述符和源地址之间的关联。它将支持多个关联(在多路径路由的情况下)，并将在路由更改时迅速更新关联。Clouseau将与两种非常有效的欺骗防御措施相集成：基于路由的过滤和跳数过滤，并将保护部署的网络免受欺骗流量的影响。(2)RAD，帮助网络保护自己免受反射器攻击。Clouseau和RAD将完全自主运行。将Clouseau部署在仅50个选定的互联网自主系统上，再加上RBF或HCF，将使互联网上的欺骗流量减少到3%以下。在隔离部署中，采用RBF或HCF的Clouseau可将部署网络收到的欺骗流量减少到3%以下。RAD系统将在隔离部署中提供针对反射器攻击的显著保护，当RAD部署在互联网核心时，将提供近乎完美的保护。这项研究正在显著减少互联网中的欺骗流量。所有代码都将向公众发布，研究生和本科生将从参与该项目中获得宝贵的培训。

0716452Jelena MirkovicUniversity of Delaware0716829Peter ReiherUCLACT-ISG: Collaborative Research: Enabling Routers to Detect and Filter Spoofed TrafficIP spoofing exacerbates many security threats.If spoofing were eliminated or sufficiently reduced, defenses against DDoS, distributed scanning and intrusions would be much simplified and more effective. Of particular interest are spoofing defenses that will be both practical (cheap to deploy and operate) and effective (provide significant benefit in sparse deployment. This project develops two such defense mechanisms: (1) Clouseau, which enables routers on asymmetric paths to accurately infer associations between the route descriptor and the source address. It will support multiple associations (in case of multipath routing) and will promptly update associations when routes change. Clouseau will be integrated with two very effective spoofing defenses: route-based filtering and hop-count filtering, and will protect deploying networks from spoofed traffic. (2) RAD, which helps networks protect themselves from reflector attacks.Clouseau and RAD will operate completely autonomously. Deployment of Clouseau at as few as 50 chosen Internet autonomous systems, together with RBF or HCF, will reduce amount of spoofed traffic on the Internet to less than 3%. In isolated deployment, Clouseau with RBF or HCF will reduce spoofed traffic received by the deploying network to less than 3%. RAD system will offer a significant protection from reflector attacks in isolated deployment and an almost perfect protection when RAD is deployed in the Internet core. This research is leading to a significant reduction of spoofed traffic in the Internet. All code will be released to the public, and graduate and undergraduate students will receive valuable training from participation in this project.