Conference paper

KOVÁČIK Michal, KAJAN Michal and ŽÁDNÍK Martin. Detecting IP-spoofing by modelling history of IP address entry points. In: Emerging Management Mechanisms for the Future Internet. Barcelona: Springer Verlag, 2013, pp. 73-83. ISBN 978-3-642-38997-9. ISSN 0302-9743.
Publication language:english
Original title:Detecting IP-spoofing by modelling history of IP address entry points
Title (cs):Detekce IP-spoofingu modelováním historie vstupních bodů IP adres
Pages:73-83
Proceedings:Emerging Management Mechanisms for the Future Internet
Conference:7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management and Security
Series:Lecture Notes in Computer Science 7943
Place:Barcelona, ES
Year:2013
ISBN:978-3-642-38997-9
Journal:Lecture Notes in Computer Science, Vol. 2013, No. 06, DE
ISSN:0302-9743
Publisher:Springer Verlag
Files: 
+Type Name Title Size Last modified
iconkovacik-kajan-zadnik_aims2013.pdfDetecting IP-spoofing by modelling history of IP address entry points247 KB2013-07-02 11:06:11
^ Select all
With selected:
Keywords
IP spoofing detection, entry points, network modeling
Annotation
Since most of the networks do not apply source IP filtering rules to its outgoing traffic an attacker may insert an arbitrary source IP address in an outgoing packet, so called IP-spoofing.
This paper elaborates on a possibility to detect IP spoofing in networks with more than one entry point. A novel detection scheme is proposed. It is based on an analysis of NetFlow data collected at the entry points.The scheme assumes that the network traffic originating from a certain source network enters the observed network via relatively stable set of points which is lower than the total number of entry points.
The scheme has been tested on data from a real network.
BibTeX:
@INPROCEEDINGS{
   author = {Michal Kov{\'{a}}{\v{c}}ik and Michal Kajan and Martin
	{\v{Z}}{\'{a}}dn{\'{i}}k},
   title = {Detecting IP-spoofing by modelling history of IP address
	entry points},
   pages = {73--83},
   booktitle = {Emerging Management Mechanisms for the Future Internet},
   series = {Lecture Notes in Computer Science 7943},
   journal = {Lecture Notes in Computer Science},
   volume = {2013},
   number = {06},
   year = {2013},
   location = {Barcelona, ES},
   publisher = {Springer Verlag},
   ISBN = {978-3-642-38997-9},
   ISSN = {0302-9743},
   language = {english},
   url = {http://www.fit.vutbr.cz/research/view_pub.php?id=10271}
}

Your IPv4 address: 54.198.165.74
Switch to IPv6 connection

DNSSEC [dnssec]