TY - GEN
T1 - Analysis of spoofed IP traffic using time-to-live and identification fields in IP headers
AU - Ohta, Masayuki
AU - Kanda, Yoshiki
AU - Fukuda, Kensuke
AU - Sugawara, Toshiharu
PY - 2011
Y1 - 2011
N2 - Internet services are often exposed to many kinds of threats such as the distributed denial of service (DDoS), viruses, and worms. Since these threats cause an adverse effect on the social and economical activities on the Internet, the technologies for protecting Internet services from the threats are strongly required. Many researchers have analyzed network traffic to detect anomalous one using many packet features (e.g., TCP/IP headers). In this paper, we focus on the Time To Live (TTL) and Identification fields (IPID) of the IP header to understand the anomalous traffic behavior, since source IP addresses are often spoofed. We propose a method to distinguish a plausible spoofed IP address from others based on a sequence of TTL and IPID fields. We show that our method can extract a number of plausible spoofing packets from real dark net traces in which all of the packets were not normal.
AB - Internet services are often exposed to many kinds of threats such as the distributed denial of service (DDoS), viruses, and worms. Since these threats cause an adverse effect on the social and economical activities on the Internet, the technologies for protecting Internet services from the threats are strongly required. Many researchers have analyzed network traffic to detect anomalous one using many packet features (e.g., TCP/IP headers). In this paper, we focus on the Time To Live (TTL) and Identification fields (IPID) of the IP header to understand the anomalous traffic behavior, since source IP addresses are often spoofed. We propose a method to distinguish a plausible spoofed IP address from others based on a sequence of TTL and IPID fields. We show that our method can extract a number of plausible spoofing packets from real dark net traces in which all of the packets were not normal.
KW - darknet
KW - network security
KW - source spoofing
UR - http://www.scopus.com/inward/record.url?scp=79957569612&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=79957569612&partnerID=8YFLogxK
U2 - 10.1109/WAINA.2011.111
DO - 10.1109/WAINA.2011.111
M3 - Conference contribution
AN - SCOPUS:79957569612
SN - 9780769543383
T3 - Proceedings - 25th IEEE International Conference on Advanced Information Networking and Applications Workshops, WAINA 2011
SP - 355
EP - 361
BT - Proceedings - 25th IEEE International Conference on Advanced Information Networking and Applications Workshops, WAINA 2011
T2 - 25th IEEE International Conference on Advanced Information Networking and Applications Workshops, WAINA 2011
Y2 - 22 March 2011 through 25 March 2011
ER -