别忘了锁前门！推断VoIP业务源地址验证的部署
Don't Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic
摘要：
本文关注的问题，在网络边缘，重要的网络安全问题的主要原因之一，没有入口过滤。许多网络运营商没有部署旨在缓解这些问题的当前最佳实践-源地址验证（SAV）。我们进行了第一次互联网范围内的主动测量研究，枚举网络不过滤传入的数据包，其源地址。测量方法包括识别封闭和开放的DNS解析器，这些解析器处理来自网络外部的请求，源地址来自被测网络内部分配的范围。所提出的方法提供了在网络提供商处的入站SAV部署状态的最完整的画面。我们发现，32 673自治系统（AS）和197 641边界网关协议（BGP）前缀容易受到欺骗的入站流量。最后，使用来自Spotify项目的数据并执行开放解析器扫描，我们比较了两个方向的过滤策略。
英文摘要：
This paper concerns the problem of the absence of ingress filtering at the network edge, one of the main causes of important network security issues. Numerous network operators do not deploy the best current practice - Source Address Validation (SAV) that aims at mitigating these issues. We perform the first Internet-wide active measurement study to enumerate networks not filtering incoming packets by their source address. The measurement method consists of identifying closed and open DNS resolvers handling requests coming from the outside of the network with the source address from the range assigned inside the network under the test. The proposed method provides the most complete picture of the inbound SAV deployment state at network providers. We reveal that 32 673 Autonomous Systems (ASes) and 197 641 Border Gateway Protocol (BGP) prefixes are vulnerable to spoofing of inbound traffic. Finally, using the data from the Spoofer project and performing an open resolver scan, we compare the filtering policies in both directions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
