使用生存时间报头信息的运营商级异常检测
Carrier-Grade Anomaly Detection Using Time-to-Live Header Information
摘要：
IP报头中的生存时间数据提供了两个有趣的特征：第一，不同的IP堆栈选择不同的起始TTL值。第二，每个被遍历的路由器应该递减TTL值。两者的结合提供了主机和路由指纹选项。我们提出了第一项研究运营商规模的互联网范围TTL行为的工作，并评估其检测异常（主要是欺骗性源IP地址）的适合性。使用专用软件，我们在40 Gbit/s的互联网上行链路上捕获了2周的原始TTL数据。为了进一步了解，我们积极测量观察到的主机，并进行大规模的基于hitlist的测量，这产生了IPv4和IPv6的三个互补数据集。大多数（69%的IPv4; 81%的IPv6）被动观察的多包主机表现出一个稳定的TTL值。对不稳定主机的主动测量为85%以上的响应主机产生稳定的锚定TTL值。我们开发了一种结构，以进一步分类不稳定的主机，例如，考虑到时间稳定性。TTL值与BGP数据的相关性是明确的，但不可预测。结果表明，运营商级TTL异常检测可以在以下类别中产生重要的见解：首先，该方法可以基于TTL观测标记异常（但可能在困难的假阳性/假阴性权衡下）。第二，该方法可以建立数据包源自其受好评的源的信任。
英文摘要：
Time-to-Live data in the IP header offers two interesting characteristics: First, different IP stacks pick different start TTL values. Second, each traversed router should decrement the TTL value. The combination of both offers host and route fingerprinting options. We present the first work to investigate Internet-wide TTL behavior at carrier scale and evaluate its fit to detect anomalies, predominantly spoofed source IP addresses. Using purpose-built software, we capture 2 weeks of raw TTL data at a 40 Gbit/s Internet uplink. For further insight, we actively measure observed hosts and conduct large-scale hitlist-based measurements, which yields three complementary data sets for IPv4 and IPv6. A majority (69% IPv4; 81% IPv6) of passively observed multi-packet hosts exhibit one stable TTL value. Active measurements on unstable hosts yield a stable anchor TTL value for more than 85% of responsive hosts. We develop a structure to further classify unstable hosts taking, for example, temporal stability into account. Correlation of TTL values with BGP data is clear, yet unpredictive. The results indicate that carrier-grade TTL anomaly detection can yield significant insights in the following categories: First, the method can flag anomalies based on TTL observations (yet likely at a difficult false positive/false negative trade-off). Second, the method can establish trust that a packet originates from its acclaimed source.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
