SLIDE 1
Detection, Classification, and Analysis
- f Inter-Domain Traffic
Detection, Classification, and Analysis of Inter-Domain Traffic - - PowerPoint PPT Presentation
Detection, Classification, and Analysis of Inter-Domain Traffic - - PowerPoint PPT Presentation
SLIDE 2
SLIDE 3
The Unsolved Spoofing Problem
Need for insights about qualitative and quantitative characteristics of spoofed traffic and AS level spoofability
SLIDE 4
Detecting Spoofed Traffic is Hard...
?
SRC IP: 149.10.4.2
?
How do we decide if a given packet has a spoofed source IP address?
SLIDE 5
Overview
SLIDE 6
Contributions
passive
SLIDE 7
Contributions
passive
SLIDE 8
Contributions
passive
SLIDE 9
Contributions
passive
SLIDE 10
Identifying Spoofed Traffic
SLIDE 11
Classifying IP Source Addresses
What we want to uncover... not of the interface of the sending host Feature we can leverage...
SLIDE 12
Classifying IP Source Addresses
What we want to uncover... not of the interface of the sending host Feature we can leverage...
SLIDE 13
Classifying IP Source Addresses
What we want to uncover... not of the interface of the sending host Feature we can leverage...
SLIDE 14
Things We Should Never See on the Internet: Bogon
IPv4 space routable (86.2%) bogon (13.8%)
Bogon
SLIDE 15
Things We Should Never See on the Internet: Unrouted
IPv4 space routable (86.2%) unrouted (18.1%) AS agnostic bogon (13.8%)
Unrouted
- not
SLIDE 16
Who is Allowed to Send What?
IPv4 space routed (68.1%) invalid valid AS specific routable (86.2%) unrouted (18.1%) AS agnostic bogon (13.8%)
valid source valid prefixes per AS
SLIDE 17
Who is Allowed to Send What?
IPv4 space routed (68.1%) invalid valid AS specific routable (86.2%) unrouted (18.1%) AS agnostic bogon (13.8%)
valid source valid prefixes per AS
SLIDE 18
Who is Allowed to Send What?
IPv4 space routed (68.1%) invalid valid AS specific routable (86.2%) unrouted (18.1%) AS agnostic bogon (13.8%)
valid source valid prefixes per AS
SLIDE 19
Identifying Invalid: Legitimate IP Address Space per AS
- ther ASes
AS B AS D AS C AS A
Public Internet
SLIDE 20
Identifying Invalid: Legitimate IP Address Space per AS
- ther ASes
AS B AS D AS C AS A
AS A announcing prefixes p1 and p2 to the other ASes Public Internet p1, p2 Announcement
Assumption
SLIDE 21
Identifying Invalid: Legitimate IP Address Space per AS
- ther ASes
AS B AS D AS C AS A
AS A announcing prefixes p1 and p2 to the other ASes Public Internet p1, p2 p1 p2 ... List of valid prefixes for AS A Announcement
SLIDE 22
Identifying Invalid: Legitimate IP Address Space per AS
- ther ASes
AS B AS D AS C AS A
Public Internet p1, p2,p3,p4,p5,p6 p4, p5, p6 p3 Extend prefix list of AS A by prefixes of downstream ASes p1 p2 p3 p4 p5 p6 Announcement
SLIDE 23
Identifying Invalid: Legitimate IP Address Space per AS
- ther ASes
AS B AS D AS C
Public Internet p1, p2,p3,p4,p5,p6 p4, p5, p6 p3 p1 p2 p3 p4 p5 p6 Announcement
AS A
Traffic from AS A with SRC IP not announced by AS A or its downstream AS Traffic Flow SRC IP ∉ {p1,p2,p3,p4,p5,p6}
NOT
SLIDE 24
Identifying invalid: Three Approaches
“Naive” approach CAIDA Customer Cone (CC) Full Cone
SLIDE 25
Identifying invalid: Three Approaches
“Naive” approach CAIDA Customer Cone (CC) Full Cone
SLIDE 26
Identifying invalid: Three Approaches
“Naive” approach CAIDA Customer Cone (CC) Full Cone
SLIDE 27
Identifying invalid: Three Approaches
“Naive” approach CAIDA Customer Cone (CC) Full Cone
SLIDE 28
Identifying invalid: Three Approaches
“Naive” approach CAIDA Customer Cone (CC) Full Cone
SLIDE 29
Challenges
Multi AS Organisations Hidden AS relationships Not all traffic is intentionally spoofed (stray traffic)
SLIDE 30
Applying Our Methodology at a Large European IXP
SLIDE 31
Flow Data
700 members 5 Tb/s 4 weeks
SLIDE 32
How Much Traffic do We Find?
Total Traffic % Bytes
- 500
1000 1500 Packet sizes Fraction of Packets 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid Regular
amplification attacks answer traffic orders of magnitude larger
SLIDE 33
How Much Traffic do We Find?
Total Traffic % Bytes
- 500
1000 1500 Packet sizes Fraction of Packets 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid Regular
amplification attacks answer traffic orders of magnitude larger
SLIDE 34
How Many IXP Member ASes Contribute?
72% 52% 57% 30% of the IXP members do not filter any class!
14.59% 9.18% 2.24% 8.92% 18.11% 16.67% 30.29% Regular Bogon Unrouted Invalid
Who Contributes? hosters end-user ISPs
SLIDE 35
How Many IXP Member ASes Contribute?
72% 52% 57% 30% of the IXP members do not filter any class!
14.59% 9.18% 2.24% 8.92% 18.11% 16.67% 30.29% Regular Bogon Unrouted Invalid
Who Contributes? hosters end-user ISPs
SLIDE 36
How Many IXP Member ASes Contribute?
72% 52% 57% 30% of the IXP members do not filter any class!
14.59% 9.18% 2.24% 8.92% 18.11% 16.67% 30.29% Regular Bogon Unrouted Invalid
Who Contributes? hosters end-user ISPs
SLIDE 37
How Many IXP Member ASes Contribute?
72% 52% 57% 30% of the IXP members do not filter any class!
14.59% 9.18% 2.24% 8.92% 18.11% 16.67% 30.29% Regular Bogon Unrouted Invalid
Who Contributes? hosters end-user ISPs
SLIDE 38
What We Find: Traffic Mix
fraction of packets 0.0 0.2 0.4 0.6 0.8 1.0 r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d 80 443 123 27015 10100 28960
- ther
TCP DST UDP DST TCP SRC UDP SRC
SLIDE 39
What We Find: Traffic Mix
fraction of packets 0.0 0.2 0.4 0.6 0.8 1.0 r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d 80 443 123 27015 10100 28960
- ther
TCP DST UDP DST TCP SRC UDP SRC
SLIDE 40
What We Find: Traffic Mix
fraction of packets 0.0 0.2 0.4 0.6 0.8 1.0 r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d r e g u l a r b
- g
- n
u n r
- u
t e d i n v a l i d 80 443 123 27015 10100 28960
- ther
TCP DST UDP DST TCP SRC UDP SRC
SLIDE 41
Attack Patterns: Selective Spoofing
SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3
63.115.52.200 64.61.128.157 115.84.242.113 12.151.32.194
SRC: 130.149.220.3SRC: 130.149.220.3 SRC: 130.149.220.3
47.96.36.133 130.149.220.3
Selective Spoofing
SLIDE 42
Attack Patterns: Selective Spoofing
SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3 SRC: 130.149.220.3
63.115.52.200 64.61.128.157 115.84.242.113 12.151.32.194
SRC: 130.149.220.3SRC: 130.149.220.3 SRC: 130.149.220.3
47.96.36.133 130.149.220.3
Attack response traffic
Selective Spoofing
SLIDE 43
Attack Patterns: Random Spoofing
130.149.220.3
SRC: 192.168.1.4 SRC: 1.1.1.1 SRC: 10.20.1.15 SRC: 123.64.10.1 SRC: 23.23.23.23 SRC: 255.255.255.0 SRC: 1.1.1.2 SRC: 23.23.23.24 SRC: 23.23.23.25 SRC: 8.8.8.8 SRC: 43.77.80.23
Random Spoofing
SLIDE 44
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 45
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 46
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 47
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 48
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 49
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 50
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 51
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 52
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 53
Random vs. Selective Spoofing
# SRC IPs / # Pkts Fraction of DST IPs 0.0 0.2 0.4 0.6 0.8 1.0
Bogon Unrouted Invalid
0.2 0.4 0.6 0.8 1.0
SLIDE 54
Who is being Spoofed? (Invalid Source IPs)
64 128 192 256 invalid
SLIDE 55
Who is being Spoofed? (Invalid Source IPs)
64 128 192 256 invalid
SLIDE 56
Who is being Spoofed? (Invalid Source IPs)
64 128 192 256 invalid
SLIDE 57
Who is being Spoofed? (Invalid Source IPs)
64 128 192 256 invalid
SLIDE 58
Who is being Spoofed? (Invalid Source IPs)
64 128 192 256 invalid
SLIDE 59
NTP Amplification Attacks
Time UDP port 123 (NTP) traffic 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 105 106 107 108
Bytes from amplifier Bytes to amplifier
SLIDE 60
NTP Amplification Attacks
Time UDP port 123 (NTP) traffic 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 105 106 107 108
Bytes from amplifier Bytes to amplifier
SLIDE 61
NTP Amplification Attacks
Time UDP port 123 (NTP) traffic 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 12:00 0:00 105 106 107 108
Bytes from amplifier Bytes to amplifier
SLIDE 62
Conclusion
SLIDE 63
Summary
Passive Very conservative minimize false positives in the wild Future work
SLIDE 64