论文标题
不要忘记锁定前门！推断源地址验证入站流量的部署
Don't Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic
论文作者
论文摘要
本文涉及在网络边缘缺乏入学过滤的问题，这是重要网络安全问题的主要原因之一。许多网络运营商不会部署最佳当前实践 - 旨在缓解这些问题的源地址验证（SAV）。我们执行首个范围内的互联网主动测量研究，以枚举网络，而不是通过其源地址过滤传入的数据包。测量方法包括识别来自网络外部的封闭和打开的DNS解析器处理请求，其源地址来自测试下网络内部分配的范围。提出的方法提供了网络提供商的入站SAV部署状态的最完整图片。我们透露，32 673个自主系统（ASE）和197 641边界网关协议（BGP）前缀很容易受到欺骗入站流量的影响。最后，使用Spoofer项目中的数据并执行开放的解析器扫描，我们将两个方向的过滤策略进行比较。
This paper concerns the problem of the absence of ingress filtering at the network edge, one of the main causes of important network security issues. Numerous network operators do not deploy the best current practice - Source Address Validation (SAV) that aims at mitigating these issues. We perform the first Internet-wide active measurement study to enumerate networks not filtering incoming packets by their source address. The measurement method consists of identifying closed and open DNS resolvers handling requests coming from the outside of the network with the source address from the range assigned inside the network under the test. The proposed method provides the most complete picture of the inbound SAV deployment state at network providers. We reveal that 32 673 Autonomous Systems (ASes) and 197 641 Border Gateway Protocol (BGP) prefixes are vulnerable to spoofing of inbound traffic. Finally, using the data from the Spoofer project and performing an open resolver scan, we compare the filtering policies in both directions.
