论文标题
观看观察者：基于非CE的逆监视以远程检测监测
Watching the Watchers: Nonce-based Inverse Surveillance to Remotely Detect Monitoring
论文作者
论文摘要
互联网用户和服务提供商通常不知道何时观看流量，而是想要一种方法来确定何时，何处和谁。我们提出了噪声，即窃听器逆监视的非CES观测值，一种方法和系统，通过在交通中传播Nonces（独特的，伪随机值）来检测监视 - 并查看它们是否意外作用，表明正在监测非CE -LADEN的流量。具体而言，我们使用像修改的类似traceroute的工具将64位nonces无害地嵌入IPv6地址，并将这些Nonces在Internet范围内传播，这使每个出站探针的源地址都独一无二。我们不断监视随后的非CE传播，即涉及这些nonces的活动或利益，例如，通过数据包捕获我们系统的基础架构。在三个实验和四个月中，噪声检测到监测超过200万次，表面上是在268个网络中，用于针对437个网络的探针。我们的结果揭示了：（a）用于安全事件处理的数据收集，（b）与第三方共享的流量信息，以及（c）在大型商业对等交易所内或附近窃听。
Internet users and service providers do not often know when traffic is being watched but desire a way to determine when, where, and by whom. We present NOISE, the Nonce Observatory for Inverse Surveillance of Eavesdroppers, a method and system that detects monitoring by disseminating nonces - unique, pseudorandom values - in traffic and seeing if they are acted upon unexpectedly, indicating that the nonce-laden traffic is being monitored. Specifically, we embed 64-bit nonces innocuously into IPv6 addresses and disseminate these nonces Internet-wide using a modified traceroute-like tool that makes each outbound probe's source address unique. We continually monitor for subsequent nonce propagation, i.e., activity or interest involving these nonces, e.g., via packet capture on our system's infrastructure. Across three experiments and four months, NOISE detects monitoring more than 200k times, ostensibly in 268 networks, for probes destined for 437 networks. Our results reveal: (a) data collection for security incident handling, (b) traffic information being shared with third parties, and (c) eavesdropping in or near a large commercial peering exchange.
