Detecting IP Spoofing by Modelling History of IP Address Entry Points - Emerging Management Mechanisms for the Future Internet Access content directly
Conference Papers Year : 2013

Detecting IP Spoofing by Modelling History of IP Address Entry Points

Michal Kováčik
  • Function : Author
  • PersonId : 1004087
Michal Kajan
  • Function : Author
  • PersonId : 1004088
Martin Žádník
  • Function : Author
  • PersonId : 994069

Abstract

Since a lot of the networks do not apply source IP filtering to its outgoing traffic, an attacker may insert an arbitrary source IP address in an outgoing packet, i.e., IP address spoofing. This paper elaborates on a possibility to detect the spoofing in a large network peering with other networks. A proposed detection scheme is based on an analysis of NetFlow data collected at the entry points in the network. The scheme assumes that the network traffic originating from a certain source network enters the network under surveillance via a relatively stable set of points. The scheme has been tested on data from the real network.
Fichier principal
Vignette du fichier
978-3-642-38998-6_9_Chapter.pdf (245.25 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01489972 , version 1 (14-03-2017)

Licence

Attribution

Identifiers

Cite

Michal Kováčik, Michal Kajan, Martin Žádník. Detecting IP Spoofing by Modelling History of IP Address Entry Points. 7th International Conference on Autonomous Infrastructure (AIMS), Jun 2013, Barcelona, Spain. pp.73-83, ⟨10.1007/978-3-642-38998-6_9⟩. ⟨hal-01489972⟩
68 View
1032 Download

Altmetric

Share

Gmail Facebook X LinkedIn More