A Cheap, Practical and Effective IP Spoofing Defense Via Self-Learning Packet Filtering

Jelena Mirkovic
University of Delaware

Monday, Feburary 12, 11:00AM
Babbio Center, Room 202
Stevens Institute of Technology
 

Abstract


IP spoofing exacerbates many security threats. While many contemporary attacks do not exploit spoofing, a large number still does - thus eliminating or reducing spoofing would greatly improve Internet security. Seven spoofing defenses have been proposed to date. Our evaluation shows that there are only two defenses - hop-count filtering (HCF) and route-based filtering (RBF) - that offer significant spoofing reduction, in sparse but strategic deployment. If deployed at 50 chosen autonomous systems these defenses reduce amount of spoofed and reflected traffic in the Internet by 95-97%, while other defenses require two orders of magnitude larger deployment for the same effectiveness.

Unfortunately, HCF and RBF have no built-in mechanism to learn the information necessary for filtering in case of asymmetric routing, multipath routing and route changes, all of which are common in today's Internet. We present the design and evaluation of the Clouseau system, which autonomously harvests the needed information from transit traffic and updates it promptly upon a route change. The information is inferred by filters applying randomized drops to TCP data traffic, which arrives from suspicious or previously unknown sources, and observing subsequent retransmissions. No communication is required with packet sources or other filters, which makes Clouseau suitable for partial deployment. We show through NS-2 simulations and experiments with a Clouseau prototype that the operation cost is reasonable and the legitimate TCP connections do not experience large delays because of randomized drops. The inference process is resilient to subversion by an attacker who is familiar with Clouseau.