An Active Telescope for Spoo fj ng Detection Raphael Hiesgen INET, - - PowerPoint PPT Presentation

▶
an active telescope for spoo fj ng detection
SMART_READER_LITE
LIVE PREVIEW

An Active Telescope for Spoo fj ng Detection Raphael Hiesgen INET, - - PowerPoint PPT Presentation

Jun 07, 2023 214 likes •408 views

An Active Telescope for Spoo fj ng Detection Raphael Hiesgen INET, Hamburg University of Applied Sciences Motivation Spoofing is a problem throughout the Internet Our focus: impact on measurements Research and operations depend on

slide-1
SLIDE 1

An Active Telescope for Spoofjng Detection

Raphael Hiesgen

INET, Hamburg University of Applied Sciences

slide-2
SLIDE 2

Motivation

  • Spoofing is a problem throughout the Internet
  • Our focus: impact on measurements
  • Research and operations depend on reliable data
  • Source address often used for geolocation
  • Application domain: UCSD Network Telescope

2

slide-3
SLIDE 3

Goal

  • Identify spoofed traffic in the IBR
  • Challenges
  • One-way communication
  • Real-time processing

3

slide-4
SLIDE 4

Probing to the Rescue

  • Introduce active measurements to probe IBR sources
  • Collect responses for a given source address
  • Check if initial packet and replies have the same sender

4

slide-5
SLIDE 5

Pseudo Source Address Validation

  • Idea: Correlate initial IP ID with the IDs of probe replies
  • Somewhat inaccurate (e.g., not all hosts reply to probes)
  • Traditionally a system-wide counter
  • Can be used to attribute packets to the same host
  • Changed due to privacy concerns
  • Now often a counter per specific addresses + protocol tuple

5

slide-6
SLIDE 6

6

IP ID Correlation

slide-7
SLIDE 7

Handshake Continuation

  • Idea: Accept TCP connections (SYN-ACK probing)
  • High accuracy (only works if the target has state)
  • Scanner behavior unclear
  • Some reply with RST, others establish the connection

7

slide-8
SLIDE 8

Spoofjng vs. Spoofjng

  • Both methods require probes from telescope addresses
  • Replies mixed in with telescope traffic
  • Impact on telescope traffic patterns unknown (so far)

8

slide-9
SLIDE 9

Implementation: Spoki

  • Native impl. based on the C++ Actor Framework (CAF)
  • Parallel packet ingestion via libtrace
  • Probing handled by scamper
  • Deployed for two IP blocks:
  • 44.0.1.0/24 @UCSD
  • 91.216.216.0/24 @BCIX

9

Spoki Telescope Scamper Internet

IBR Subset Targets P r

  • b

e s Replies

B a c k e n d

Results Regular

slide-10
SLIDE 10

Challenges

  • Reliably provoke replies
  • Handle the data amount in real-time
  • Identifies valid packets instead of spoofed ones

10

slide-11
SLIDE 11

ICMP

  • Probe with ICMP echo requests, analyze IP IDs of replies

11

Events/Hour Total Events Got Reply Validated UCSD 40 573 346 (60%) 90 (16%) BCIX 30 464 349 (75%) 85 (15%)

slide-12
SLIDE 12

TCP

  • Send SYN-ACK probe to complete the handshake

12

Per Hour Total Events Got Reply Validated UCSD 5.439 78.705 65,651 (83%) 7,323 (9%) BCIX 5.780 93.682 78,954 (84%) 10,146 (11%)

slide-13
SLIDE 13

RST Replies

13

  • 15 most targeted ports for events that replied with RST to probes

BCIX UCSD

slide-14
SLIDE 14

No Replies

  • 15 most targeted ports for events did not get a reply

14

BCIX UCSD

slide-15
SLIDE 15

Regular Replies

  • 15 most targeted ports for events that replied with non-RST to probes

15

BCIX UCSD

slide-16
SLIDE 16

UDP

  • Reflect payload, analyze IP IDs of replies

16

Per Hour Total Events Got Reply Validated BCIX 215 3.241 175 (5%) 23 (1%)

slide-17
SLIDE 17

Services

17

  • 30 most targeted ports

BCIX

slide-18
SLIDE 18

Provoking UDP Replies

  • Problem: no standardized communication protocol
  • Attempts so far:
  • Send service-specific probes
  • Send newline characters
  • Reflect payloads
  • Reply with ICMP destination unreachable — MTU exceeded

18

slide-19
SLIDE 19

Next Steps

  • Methodology
  • Validate the TCP results or find out how to improve them
  • UDP is very unstable and requires work
  • How to extend the inferences to the entire /8?
  • Can we transfer the technique into other contexts?

19