恶意IP源的最优过滤
Optimal Filtering of Malicious IP Sources
摘要：
我们如何保护网络基础设施免受恶意流量（如扫描、恶意代码传播和分布式拒绝服务（DDoS）攻击）的侵害？一种阻止恶意流量的机制是过滤：访问控制列表（Access Control List，简称ACL）可以根据IP报头的字段选择性地阻止流量。过滤器（Filter，缩写为REQ）已经存在于今天的路由器中，但由于它们存储在昂贵的三进制内容可寻址存储器（TCAM）中，因此是一种稀缺资源。在本文中，我们开发，第一次，一个框架，研究过滤器选择作为一个资源分配问题。在这个框架内，我们研究了五个实际情况下的源地址/前缀过滤，这对应于不同的攻击场景和运营商的政策。我们表明，过滤器选择优化导致新的变化的多维背包问题，我们设计最佳的，但计算效率高，算法来解决这些问题。我们还使用来自Dshield.org的数据评估了我们的方法，并证明它在实践中带来了显着的好处。我们的算法集是一个构建块，可以立即被运营商和制造商使用，以经济高效的方式阻止恶意流量。
英文摘要：
How can we protect the network infrastructure from malicious traffic, such as scanning, malicious code propagation, and distributed denial-of-service (DDoS) attacks? One mechanism for blocking malicious traffic is filtering: access control lists (ACLs) can selectively block traffic based on fields of the IP header. Filters (ACLs) are already available in the routers today but are a scarce resource because they are stored in the expensive ternary content addressable memory (TCAM). In this paper, we develop, for the first time, a framework for studying filter selection as a resource allocation problem. Within this framework, we study five practical cases of source address/prefix filtering, which correspond to different attack scenarios and operator's policies. We show that filter selection optimization leads to novel variations of the multidimensional knapsack problem and we design optimal, yet computationally efficient, algorithms to solve them. We also evaluate our approach using data from Dshield.org and demonstrate that it brings significant benefits in practice. Our set of algorithms is a building block that can be immediately used by operators and manufacturers to block malicious traffic in a cost-efficient way.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
