InFilter: Predictive Ingress Filtering to Detect Spoofed IP Traffic

Abstract

Cyber-attackers often use incorrect source IP addresses in attack packets (spoofed IP packets) to achieve anonymity, reduce the risk of trace-back and avoid detection. We present the predictive ingress filtering (InFilter) approach for network-based detection of spoofed IP packets near cyber-attack targets. Our InFilter hypothesis states that traffic entering an IP network from a specific source frequently uses the same ingress point. We have empirically validated this hypothesis by analysis of trace-routes to 20 Internet targets from 24 LookingGlass sites, and 30-days of Border Gateway Protocolderived path information for the same 20 targets. We have developed a system architecture and software implementation based on the InFilter approach that can be used at Border Routers of large IP networks to detect spoofed IP traffic. Our implementation had a detection rate of about 80% and a false positive rate of about 2% in testbed experiments using Internet traffic and real cyber-attacks.

On the use of BGP AS numbers to detect spoofing

“…This is an extension of the hypothesis used in [5] which says that the same 'last hop' AS is used by packets from the same source AS prior to entering the destination AS. This is a reasonable extension based on the fact that traffic routes within an AS change infrequently.…”

“…Techniques such as [4] and [5] rely on historical observations of IP addresses to identify spoofed traffic. Since our technique maps the IP addresses to AS numbers, we are able to classify as legitimate or spoofed, traffic with IP addresses that have never been observed before, as long as some traffic from the same origin AS has been observed.…”

“…It stores network profiling information in terms of BGP AS (Autonomous System) numbers rather than network IP addresses. This allows for both concise data representation as well as the ability to draw inferences about IP traffic from previously unobserved sources, thus mitigating a major drawback of [5].…”

“…The InFilter scheme discussed in [5] addresses some of the shortcomings of [4]. It presents a predictive filtering approach that makes use of an "InFilter" hypothesis to detect spoofed source IP addresses in traffic near its destination.…”