SMap：针对IP欺骗的互联网范围扫描
SMap: Internet-wide Scanning for Spoofing
AI总结：
本研究提出首款互联网范围入站过滤扫描器SMap，利用通用标准协议评估网络可欺骗性，测得69.8%的自治系统未过滤伪造数据包，发现4.6万余个新可欺骗AS，并公开工具与数据以支撑相关研究与持续监测。
摘要：
为了抵御攻击，网络需要实施入站过滤，即拦截来自伪造IP地址的入站数据包。尽管这是公认的最佳实践，但目前仍不清楚有多少网络未拦截伪造数据包。在互联网规模下推断IP欺骗的可行范围极具挑战性，尽管已有多项研究，但现有研究仅覆盖有限的互联网网络：它们要么只能测量存在网络栈实现缺陷的服务器所属网络，要么需要在志愿网络中安装测量软件，要么依赖特定网络特性（如路由跟踪环路）。提升IP欺骗测量的覆盖范围至关重要。\n在本研究中，我们提出了欺骗映射器（Spoofing Mapper, SMap）：这是首款用于开展互联网范围入站过滤研究的扫描器。SMap利用几乎所有互联网网络都支持的标准协议评估网络的可欺骗性。我们将SMap应用于入站过滤的互联网范围测量：发现互联网中69.8%的自治系统（Autonomous Systems, ASes）未过滤伪造数据包，还发现了46880个此前研究未识别的新可欺骗AS。我们通过SMap开展的测量首次全面呈现了互联网入站过滤的部署情况，以及截至2021年5月的两年间网络在伪造数据包过滤方面的修复进展。\n我们在https://smap.cad.sit.fraunhofer.de搭建了网络服务，使用SMap持续开展互联网范围的数据收集并展示IP欺骗评估的统计数据。我们公开了数据集以及SMap（含实现代码与源代码），以便研究人员复现和验证我们的结果，同时持续追踪互联网中伪造数据包过滤情况的变化。
英文摘要：
To protect themselves from attacks, networks need to enforce ingress filtering, i.e., block inbound packets sent from spoofed IP addresses. Although this is a widely known best practice, it is still not clear how many networks do not block spoofed packets. Inferring the extent of spoofability at Internet scale is challenging and despite multiple efforts the existing studies currently cover only a limited set of the Internet networks: they can either measure networks that operate servers with faulty network-stack implementations, or require installation of the measurement software on volunteer networks, or assume specific properties, like traceroute loops. Improving coverage of the spoofing measurements is critical. In this work we present the Spoofing Mapper (SMap): the first scanner for performing Internet-wide studies of ingress filtering. SMap evaluates spoofability of networks utilising standard protocols that are present in almost any Internet network. We applied SMap for Internet-wide measurements of ingress filtering: we found that 69.8% of all the Autonomous Systems (ASes) in the Internet do not filter spoofed packets and found 46880 new spoofable ASes which were not identified in prior studies. Our measurements with SMap provide the first comprehensive view of ingress filtering deployment in the Internet as well as remediation in filtering spoofed packets over a period of two years until May 2021. We set up a web service at https://smap.cad.sit.fraunhofer.de to perform continual Internet-wide data collection with SMap and display statistics from spoofing evaluation. We make our datasets as well as the SMap (implementation and the source code) publicly available to enable researchers to reproduce and validate our results, as well as to continually keep track of changes in filtering spoofed packets in the Internet.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
