CT-ISG: Collaborative research: Enabling Routers to Detect and Filter Spoofed Traffic

peter ReiherUCLACT-ISG：合作研究：使路由器能够检测和过滤欺骗流量ip欺骗加剧了许多安全威胁。如果欺骗被消除或充分减少，对DDoS、分布式扫描和入侵的防御将大大简化和更有效。我们特别感兴趣的是既实用（部署和操作成本低）又有效（在稀疏部署中提供显著好处）的欺骗防御。本项目开发了两种这样的防御机制：(1)Clouseau，它使非对称路径上的路由器能够准确地推断路由描述符和源地址之间的关联。它将支持多个关联（在多路径路由的情况下），并在路由发生变化时及时更新关联。Clouseau将集成两种非常有效的欺骗防御：基于路由的过滤和跳数过滤，并将保护部署网络免受欺骗流量的影响。(2) RAD，帮助网络保护自己免受反射器攻击。Clouseau和RAD将完全自主运行。在50个选定的互联网自治系统上部署Clouseau，再加上RBF或HCF，将把互联网上的欺骗流量减少到3%以下。在孤立部署中，使用RBF或HCF的Clouseau将部署网络接收的欺骗流量减少到3%以下。RAD系统在孤立部署时对反射器攻击具有显著的保护作用，在互联网核心部署时具有近乎完美的保护作用。这项研究正在导致互联网上欺骗流量的显著减少。所有代码都将向公众发布，研究生和本科生将从参与该项目中获得宝贵的培训。

0716452Jelena MirkovicUniversity of Delaware0716829Peter ReiherUCLACT-ISG: Collaborative Research: Enabling Routers to Detect and Filter Spoofed TrafficIP spoofing exacerbates many security threats.If spoofing were eliminated or sufficiently reduced, defenses against DDoS, distributed scanning and intrusions would be much simplified and more effective. Of particular interest are spoofing defenses that will be both practical (cheap to deploy and operate) and effective (provide significant benefit in sparse deployment. This project develops two such defense mechanisms: (1) Clouseau, which enables routers on asymmetric paths to accurately infer associations between the route descriptor and the source address. It will support multiple associations (in case of multipath routing) and will promptly update associations when routes change. Clouseau will be integrated with two very effective spoofing defenses: route-based filtering and hop-count filtering, and will protect deploying networks from spoofed traffic. (2) RAD, which helps networks protect themselves from reflector attacks.Clouseau and RAD will operate completely autonomously. Deployment of Clouseau at as few as 50 chosen Internet autonomous systems, together with RBF or HCF, will reduce amount of spoofed traffic on the Internet to less than 3%. In isolated deployment, Clouseau with RBF or HCF will reduce spoofed traffic received by the deploying network to less than 3%. RAD system will offer a significant protection from reflector attacks in isolated deployment and an almost perfect protection when RAD is deployed in the Internet core. This research is leading to a significant reduction of spoofed traffic in the Internet. All code will be released to the public, and graduate and undergraduate students will receive valuable training from participation in this project.