Collaborative Research: CT-ISG. Enabling Routers to Detect and Filter Spoofed Traffic

0716452 Jelena Mirkovic 0716829 Peter ReiherUCLACT-ISG：合作研究：使路由器能够检测和过滤欺骗性IP欺骗加剧了许多安全威胁。如果消除或充分减少欺骗，对DDoS，分布式扫描和入侵的防御将大大简化和更有效。特别感兴趣的是欺骗防御，这将是既实用（部署和操作便宜）和有效（在稀疏部署中提供显着的好处。本项目开发了两种这样的防御机制：（1）Clouseau，它使非对称路径上的路由器能够准确地推断路由描述符和源地址之间的关联。它将支持多个关联（在多路径路由的情况下），并将在路由改变时立即更新关联。Clouseau将与两个非常有效的欺骗防御集成：基于路由的过滤和跳数过滤，并将保护部署网络免受欺骗流量的影响。(2)RAD，帮助网络保护自己免受反射器攻击。克劳索和RAD将完全自主运行。在最少50个选定的互联网自治系统上部署Clouseau，以及RBF或HCF，将使互联网上的欺骗流量减少到3%以下。在隔离部署中，具有RBF或HCF的Clouseau将部署网络接收的欺骗流量减少到3%以下。RAD系统在孤立部署时可以有效地抵御反射器攻击，在Internet核心部署时可以提供近乎完美的保护。这项研究正在导致互联网中欺骗流量的显着减少。所有的代码都将向公众发布，研究生和本科生将从参与这个项目中获得宝贵的培训。

0716452Jelena MirkovicUniversity of Delaware0716829Peter ReiherUCLACT-ISG: Collaborative Research: Enabling Routers to Detect and Filter Spoofed TrafficIP spoofing exacerbates many security threats.If spoofing were eliminated or sufficiently reduced, defenses against DDoS, distributed scanning and intrusions would be much simplified and more effective. Of particular interest are spoofing defenses that will be both practical (cheap to deploy and operate) and effective (provide significant benefit in sparse deployment. This project develops two such defense mechanisms: (1) Clouseau, which enables routers on asymmetric paths to accurately infer associations between the route descriptor and the source address. It will support multiple associations (in case of multipath routing) and will promptly update associations when routes change. Clouseau will be integrated with two very effective spoofing defenses: route-based filtering and hop-count filtering, and will protect deploying networks from spoofed traffic. (2) RAD, which helps networks protect themselves from reflector attacks.Clouseau and RAD will operate completely autonomously. Deployment of Clouseau at as few as 50 chosen Internet autonomous systems, together with RBF or HCF, will reduce amount of spoofed traffic on the Internet to less than 3%. In isolated deployment, Clouseau with RBF or HCF will reduce spoofed traffic received by the deploying network to less than 3%. RAD system will offer a significant protection from reflector attacks in isolated deployment and an almost perfect protection when RAD is deployed in the Internet core. This research is leading to a significant reduction of spoofed traffic in the Internet. All code will be released to the public, and graduate and undergraduate students will receive valuable training from participation in this project.