论文标题
SMAP：遍布网络的扫描以进行欺骗
SMap: Internet-wide Scanning for Spoofing
论文作者
论文摘要
为了保护自己免受攻击，网络需要强制执行入口过滤，即从欺骗的IP地址发送的块入站数据包。尽管这是一种众所周知的最佳实践，但仍不清楚多少网络不会阻止欺骗数据包。在Internet规模上推断出欺骗性的程度是具有挑战性的，尽管现有研究目前仅涵盖了一组有限的互联网网络：他们可以测量以有缺陷的网络堆栈实现操作服务器的网络，或者需要在志愿者网络上安装测量软件，或者假设特定的属性，例如Traceroute Loops。提高欺骗测量的覆盖范围至关重要。 在这项工作中，我们介绍了欺骗映射器（SMAP）：第一个进行互联网范围内入口过滤研究的扫描仪。 SMAP评估了使用几乎任何Internet网络中存在的标准协议的网络的欺骗性。我们将SMAP应用于互联网范围的入口过滤测量：我们发现Internet中所有自主系统（ASE）中有69.8％不会过滤伪造的数据包，并发现46880个新的可欺骗ASE，这些ASE在先前的研究中未发现。我们使用SMAP进行的测量提供了在互联网中进行过滤部署的首个综合视图，以及在两年内过滤欺骗数据包的补救，直到2021年5月。 我们在https://smap.cad.sit.fraunhofer.de上设置了一个Web服务，以执行持续的Internet范围内数据收集，并显示SMAP并显示欺骗评估的统计信息。我们可以公开使用SMAP（实现和源代码），以使研究人员能够复制和验证我们的结果，并不断跟踪Internet中过滤欺骗数据包的变化。
To protect themselves from attacks, networks need to enforce ingress filtering, i.e., block inbound packets sent from spoofed IP addresses. Although this is a widely known best practice, it is still not clear how many networks do not block spoofed packets. Inferring the extent of spoofability at Internet scale is challenging and despite multiple efforts the existing studies currently cover only a limited set of the Internet networks: they can either measure networks that operate servers with faulty network-stack implementations, or require installation of the measurement software on volunteer networks, or assume specific properties, like traceroute loops. Improving coverage of the spoofing measurements is critical. In this work we present the Spoofing Mapper (SMap): the first scanner for performing Internet-wide studies of ingress filtering. SMap evaluates spoofability of networks utilising standard protocols that are present in almost any Internet network. We applied SMap for Internet-wide measurements of ingress filtering: we found that 69.8% of all the Autonomous Systems (ASes) in the Internet do not filter spoofed packets and found 46880 new spoofable ASes which were not identified in prior studies. Our measurements with SMap provide the first comprehensive view of ingress filtering deployment in the Internet as well as remediation in filtering spoofed packets over a period of two years until May 2021. We set up a web service at https://smap.cad.sit.fraunhofer.de to perform continual Internet-wide data collection with SMap and display statistics from spoofing evaluation. We make our datasets as well as the SMap (implementation and the source code) publicly available to enable researchers to reproduce and validate our results, as well as to continually keep track of changes in filtering spoofed packets in the Internet.
