Method for source-spoofed IP packet traceback

• US 8,059,551 B2
• Filed: 02/15/2006
• Issued: 11/15/2011
• Est. Priority Date: 02/15/2005
• Status: Expired due to Fees

• Current Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Original Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Inventors: Milliken, Walter
• Primary Examiner(s): Pezzlo; John
• Application Number:
  US11/355,484
• Publication Number:
  US 20060184690A1
• Time in Patent Office: 2,099 Days
• Field of Search: 370/389, 370/419, 370/252
• US Class Current: 370/252
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Method for source-spoofed internet protocol packet traceback. This is an IP packet traceback technique for locating the origin of a malicious packet, even if the packet'"'"'s IP source address is incorrect (spoofed). This is done by having routers lookup the source address in their routing tables, and mark the relevant entry.

Claims

1. A method for tracing source spoofed network communications on a network comprising:

providing a table, which is configured to include;

a single entry for each of a plurality of distinct sub-blocks of source addresses, wherein each distinct sub-block of source addresses corresponds to a plurality of source addresses on the network capable of sending a network communication; and

a plurality of use bits, each associated with respective ones of the plurality of distinct sub-blocks of source addresses;

when a network communication arrives, modifying the use bit corresponding to at least one sub-block of source addresses associated with the network communication; and

analyzing the use bits to trace the source of a spoofed network communication being forwarded over the network.

2. The method according to claim 1 wherein analyzing further comprises compiling a partial list of use bits at specified time intervals.

3. The method according to claim 2 further comprising resetting the use bits at specified time intervals.

4. The method according to claim 2 wherein, the compilation is performed by either a network operations center or a third party agent.

5. The method according to claim 1 further comprising collecting use bits responsive to an investigation command.

6. The method according to claim 1 wherein providing a plurality of use bits includes modifying a look-up table of a router on a network to associate the plurality of use bits with a plurality of source addresses in the look up table.

7. The method according to claim 1 further comprising collecting use bits having a second binary value.

8. The method according to claim 1 further comprising iteratively querying use bits of one or more nearest neighbor routers until a source subnet is traced for the network communication.

9. The method according to claim 1, wherein analyzing comprises:

polling a neighbor nearest a router to determine if the neighbor has forwarded a network communication exhibiting a spoofed sub-block of addresses.

10. The method according to claim 9, wherein analyzing the tracing comprises:

iterating the query, if the neighbor has forwarded a network communication exhibiting the spoofed sub-block of addresses, by polling the neighbor'"'"'s neighbors.

11. The method according to claim 1 further comprising using network routing and topology data to trace the source of a spoofed network communication and identify an attack path.

12. The method according to claim 11 further comprising collecting data from a subset of nodes of an attack path.

13. The method according to claim 1 further comprising recording an interface from which the network communication is received.

14. The method according to claim 1 wherein, the sub-block of addresses comprises all address bits.

15. The method according to claim 1 further comprising applying a hashing function or Bloom filter to the address bits.

16. The method according to claim 1 further comprising detecting routing errors based on, at least in part, the use bits.

17. The method according to claim 1 further comprising determining routing related SLA violations based on, at least in part, the use bits.

18. The method according to claim 1 further comprising periodically compiling use bits to detect unexpected network communications.

19. The method according to claim 1 further comprising periodically compiling the use bits and analyzing the compilation to determine network traffic patterns.

20. The method according to claim 19 further comprising determining network connectivity between two or more network nodes.

21. The method according to claim 1, wherein analyzing the use bits comprises responding to a query regarding receipt of a packet from a node having an address within one of the sub-blocks of source addresses based on a value of a corresponding use bit.

22. The method according to claim 21 further comprising iterating the query to at least one neighboring node.

23. The method according to claim 1, wherein the single entry for each of the plurality of distinct sub-blocks of source addresses correspond to distinct subnets within the network.

24. The method according to claim 23, wherein the plurality of source addresses correspond to network devices associated with a respective distinct subnet.

25. The method according to claim 1, wherein the single entry for each of the plurality of distinct sub-blocks of source addresses is a Internet Protocol source address prefix.

26. A method for tracing a source spoofed network communication having a source spoofed prefix over a plurality of routers comprising:

providing a plurality of look-up tables associated with respective ones of the plurality of routers configured to include;

a single entry for each of a plurality of distinct source prefixes, wherein each distinct source prefix corresponds to a plurality of addresses on a network; and

a plurality of use bits, each associated with respective ones of the plurality of distinct source prefixes;

upon arrival of a new network communication, looking up a source prefix in a look-up table, the source prefix being contained in the network communication header;

if the source prefix is found within the look-up table, writing a first binary value to the use bit associated the found table entry;

if the source prefix is not found within the look-up table, writing a new table entry into the look-up table; and

collecting at least a partial list of the look-up table from to trace the source of a spoofed network communication being forwarded over the network.

27. The method according to claim 26 further comprising compiling all the table entries in the first router at predetermined time intervals.

28. The method according to claim 26 further comprising collecting all the table entries containing use bit with the first binary value from the first router.

29. The method according to claim 26, wherein a second binary value in the user bit represents that a network communication containing a source prefix in its network communication header has not been forwarded by the first router.

30. The method according to claim 29 further comprising writing the second binary value to each of the collected table entries.

31. The method according to claim 30 further comprising substituting a internet protocol destination look-up table disposed in the first router with a first look-up table.

32. The method according to claim 26, wherein each table entry of the look-up table further comprises a time stamp field.

33. The method according to claim 26 further comprising writing a time stamp in each table entry when the first binary value is written to the user bit in each of the table entries.

34. A system for tracing a source spoofed network communication, comprising:

a table configured to include a single entry for each of a plurality of distinct sub-blocks of source addresses, wherein each distinct sub-block of source addresses corresponds to a plurality of source addresses on the network capable of sending a network communication, and

a plurality of use bits, each associated with respective ones of the plurality of distinct sub-blocks of source addresses,

a look up process for, when a network communication arrives, modifying the use bit corresponding to at least one sub-block of source addressed associated with the network communication; and

a traceback agent for analyzing the use of bits to trace the source of a spoofed network communication being forwarded over the network.

35. A method for tracing source spoofed network communications on a network in which nodes on the network maintain tables that are configured to include a single entry for each of a plurality of distinct sub-blocks of source addresses and use bits, wherein each distinct sub-block of source addresses corresponds to a plurality of source addresses, and wherein each use bit is associated with respective ones of the plurality of distinct sub-blocks of source addresses, the method comprising:

polling the tables of a first set of neighboring nodes to determine, based on use bits stored in the tables, if any of the nodes in the first set of neighboring nodes received a communication from a node in a sub-block of source addresses associated with a spoofed network communication;

receiving at least one response to the poll;

in response to a responding node indicating that it had received a communication from the sub-block of source addresses with the spoofed network communication, querying the routing tables of a second set of nodes neighboring the responding node, to trace the source of the spoofed communication.