无攻击者存在的可用性攻击：来自企业局域网的证据
Availability Attacks Without an Adversary: Evidence from Enterprise LANs
AI总结：
本文研究了企业局域网中非恶意内部行为导致的可用性问题，通过RSTP协议的控制平面重新计算，引发实时流媒体服务中断，并提出通过配置边缘端口来缓解问题的方法。
摘要：
企业网络中的拒绝服务（DoS）条件通常归因于恶意行为者。然而，可用性也可能受到良性非恶意内部行为的影响。本文对一个生产企业局域网进行了实证研究，展示了用户端点的常规插拔行为如何反复触发快速重新计算快速生成树协议（RSTP）的控制平面。尽管协议合规且非恶意，这些事件引入了持续约2-4秒的转发中断，影响实时流媒体（语音和视频）服务，同时在传统安全监控下几乎未被检测到。我们将这一现象映射到NIST和MITRE内部威胁框架，将其定义为无意的内部驱动可用性漏洞，并证明显式的边缘端口配置可以有效缓解该情况而不影响环路预防。
英文摘要：
Denial-of-Service (DoS) conditions in enterprise networks are commonly attributed to malicious actors. However, availability can also be compromised by benign non-malicious insider behavior. This paper presents an empirical study of a production enterprise LAN that demonstrates how routine docking and undocking of user endpoints repeatedly trigger rapid recalculations of the control plane of the Rapid Spanning Tree Protocol (RSTP) [1]. Although protocol-compliant and nonmalicious, these events introduce transient forwarding disruptions of approximately 2-4 seconds duration that degrade realtime streaming (voice and video) services while remaining largely undetected by conventional security monitoring. We map this phenomenon to the NIST and MITRE insider threat frameworks, characterizing it as an unintentional insider-driven availability breach, and demonstrate that explicit edge-port configuration effectively mitigates the condition without compromising loop prevention
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
