BGPeek-a-Boo：基于BGP的主动回溯，用于扩增DDoS攻击
BGPeek-a-Boo: Active BGP-based Traceback for Amplification DDoS Attacks
摘要：
DDoS攻击本质上依赖于IP欺骗来将攻击流量引导到受害者。与此同时，IP欺骗破坏了起诉，因为发起攻击的基础设施仍然是隐藏的。因此，研究人员提出了各种机制来追溯放大攻击（或一般的IP欺骗攻击）。然而，现有的回溯技术需要外部各方的合作或关于攻击者的先验知识。我们提出了BGPeek-a-Boo，这是一种基于BGP的方法，可以将放大攻击追溯到其起源网络。BGPeek-a-Boo使用蜜罐监控放大攻击，并使用BGP中毒暂时关闭来自选定自治系统的入口流量。通过系统地探测整个AS空间，我们检测系统转发和始发欺骗流量。然后，我们展示了如何基于图的BGP路由传播模型可以减少搜索空间，导致在5倍的中位数速度和超过20倍的1/4的所有情况下。BGPeek-a-Boo在基于模拟的评估中实现了60%的独特回溯结果，并得到了真实世界实验的支持。
英文摘要：
Amplification DDoS attacks inherently rely on IP spoofing to steer attack traffic to the victim. At the same time, IP spoofing undermines prosecution, as the originating attack infrastructure remains hidden. Researchers have therefore proposed various mechanisms to trace back amplification attacks (or IP-spoofed attacks in general). However, existing traceback techniques require either the cooperation of external parties or a priori knowledge about the attacker. We propose BGPeek-a-Boo, a BGP-based approach to trace back amplification attacks to their origin network. BGPeek-a-Boo monitors amplification attacks with honeypots and uses BGP poisoning to temporarily shut down ingress traffic from selected Autonomous Systems. By systematically probing the entire AS space, we detect systems forwarding and originating spoofed traffic. We then show how a graph-based model of BGP route propagation can reduce the search space, resulting in a 5x median speed-up and over 20x for 1/4 of all cases. BGPeek-a-Boo achieves a unique traceback result 60% of the time in a simulation-based evaluation supported by real-world experiments.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
