a technique for network topology deception
play

A Technique for Network Topology Deception Samuel Trassare, Robert - PowerPoint PPT Presentation

Feb 19, 2023 •250 likes •490 views

A Technique for Network Topology Deception Samuel Trassare, Robert Beverly, David Alderson Naval Postgraduate School {sttrassa,rbeverly,dladers}@nps.edu June 18, 2013 NPS Topology Meeting S. Trassare et al. (NPS) A Technique for Network

  1. A Technique for Network Topology Deception Samuel Trassare, Robert Beverly, David Alderson Naval Postgraduate School {sttrassa,rbeverly,dladers}@nps.edu June 18, 2013 NPS Topology Meeting S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 1 / 23

  2. Background Outline Background 1 Methodology 2 Results 3 Discussion 4 S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 2 / 23

  3. Background traceroute Active Network Topology Measurement traceroute and its variants source active TTL-limited probes to infer (remote) network connectivity and structure. traceroute reports hops along a forward path based on the source IP address of received ICMP TTL time exceeded packets. Useful diagnostic tool, invaluable to network topology researchers. Recall: traceroute is a happy hack (thanks Van Jacobson!). Internet never intended to be mapped. S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 3 / 23

  4. Background traceroute in Practice Real-world traceroute : For security, policy, and economic reasons, many providers actively prevent traceroute measurement Many routers do not respond with ICMP when TTL expires Many routers block ICMP In real-world traces, only ≤ 15% of random traces complete. S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 4 / 23

  5. Background traceroute in Practice Real-world traceroute : Long history of bad topology inferences by researchers e.g. false links, missing links, etc. “ What are our standards for validation of measurement-based networking research? ” (Krishnamurthy, Willinger) “ Mathematics and the Internet: A source of enormous confusion and great potential ” (Willinger, Alderson, Doyle) Implication: criticism of active traceroute -based topology measurement with respect to accuracy of inferred network(s). S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 5 / 23

  6. Background Network Topology Deception Fooling Traceroute Our insight: the inherent measurement weaknesses of traceroute provide an opportunity The same measurement weaknesses imply that it is easy (trivial) to fool a remote traceroute There is value to fooling traceroute We introduce a new sub-field: Network Topology Deception S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 6 / 23

  7. Background Defending a Network Other ways traceroute is used: Of course, network probing is not limited to innocuous measurement researchers Networks are frequently and regularly probed for vulnerabilities Mapping potentially reveals critical details of a network’s connectivity traceroute used as a reconnaissance tool to understand which links/routers to target for attack to partition network S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 7 / 23

  8. Background Military Deception Deception in Cyberspace Leverage concept of military deception for cyberspace: Manipulate network traffic to deceive adversary and influence his/her decision making. Cause adversary to attack false targets, dilute attack, etc. May be preferable to outright blocking (“that must be an interesting target...”) Analogy with deceptive radar returns in meatspace. S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 8 / 23

  9. Methodology Outline Background 1 Methodology 2 Results 3 Discussion 4 S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 9 / 23

  10. Methodology Topology Deception Sardine: Topology Deception Rather than block topology probes, return modified responses that cause adversary to infer a false topology: Continuum: random vs. crafted responses Graph theory: make weakest portion of topology appear to be most robust Keep adversary in collection rather than operational phase. Confuse adversary into believing least resilient portion of network is most robust. S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 10 / 23

  11. Methodology Topology Deception Sardine: Topology Deception Deception may be arbitrary We choose one exemplar utility function, minimizing the maximum betweenness centrality Analysis Script: Config File Linux Deception True Topology Minimize maximum Kernel Module centrality S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 11 / 23

  12. Methodology Sardine Example Attacker Attacker R1 R1 R2 R12 R13 R10 R11 R3 H1 H2 H1 H2 Faked Topology, False Links, Missing Links True Topology, Vulnerable Links S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 12 / 23

  13. Methodology Development Prototype: Linux-based router using libnetfilter_queue Runs as a kernel module Configurable per-TTL hops Configurable ICMP port unreachable (path length) Deterministic delay component Fake packets we originate sourced with a TTL corresponding to incoming TTL S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 13 / 23

  14. Results Outline Background 1 Methodology 2 Results 3 Discussion 4 S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 14 / 23

  15. Results Topology Deception Candidate test topology in our lab (using GNS3) S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 15 / 23

  16. Results True Topology traceroute to 192.168.5.2 (192.168.5.2), 30 hops 1 192.168.9.1 1.280 ms (R1) 2 192.168.0.2 3.966 ms (Intelligent Router) 3 192.168.1.2 5.997 ms (R2) 4 192.168.2.2 10.097 ms (R3) 5 192.168.3.2 12.135 ms (R4) 6 192.168.4.2 14.330 ms (R5) 7 192.168.5.2 16.109 ms (Web Server) S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 16 / 23

  17. Results Random Topology traceroute to 192.168.5.2 (192.168.5.2), 30 hops 1 192.168.9.1 1.039 ms 2 132.65.218.87 3.996 ms 3 240.184.140.169 3.935 ms 4 247.10.122.16 4.178 ms 5 153.55.189.76 3.956 ms 6 255.253.22.13 4.126 ms 7 112.52.193.63 3.942 ms 8 213.218.8.151 2.829 ms ... S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 17 / 23

  18. Results Deceptive Topology traceroute to 192.168.5.2 (192.168.5.2), 30 hops 1 192.168.9.1 2.478 ms (R1) 2 192.168.0.2 15.078 ms (Intelligent Router) 3 192.168.4.2 22.520 ms (R5) 4 192.168.5.2 32.739 ms (Web Server) S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 18 / 23

  19. Discussion Outline Background 1 Methodology 2 Results 3 Discussion 4 S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 19 / 23

  20. Discussion Does Topology Deception Already Exist? Relatively simple to perform topology deception Current mapping systems could be influenced by fake topology Only prior work we are aware of used virtual forwarding tables (VRFs) on a single router to encode a message in DNS PTR records Fundamentally different – packets are actually being forwarded S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 20 / 23

  21. Discussion Prior Art? VRF-Based DNS Tricks traceroute to 216.81.59.173 (216.81.59.173), 30 hops max, 60 byte packets 13 Episode.IV (206.214.251.1) 65.780 ms 67.914 ms 68.976 ms 14 A.NEW.HOPE (206.214.251.6) 66.577 ms 62.461 ms 65.629 ms 15 It.is.a.period.of.civil.war (206.214.251.9) 63.648 ms 64.774 ms 66.707 ms 16 Rebel.spaceships (206.214.251.14) 65.418 ms 62.541 ms 62.739 ms 17 striking.from.a.hidden.base (206.214.251.17) 63.203 ms 63.160 ms 62.312 ms 18 have.won.their.first.victory (206.214.251.22) 62.553 ms 63.069 ms 63.364 ms 19 against.the.evil.Galactic.Empire (206.214.251.25) 63.543 ms 63.404 ms 62.960 ms 20 During.the.battle (206.214.251.30) 62.878 ms 62.742 ms 63.378 ms 21 Rebel.spies.managed (206.214.251.33) 62.808 ms 62.351 ms 62.075 ms 22 to.steal.secret.plans (206.214.251.38) 62.829 ms 63.266 ms 63.256 ms 23 to.the.Empires.ultimate.weapon (206.214.251.41) 63.585 ms 63.652 ms 63.671 ms 24 the.DEATH.STAR (206.214.251.46) 63.002 ms 63.124 ms 63.120 ms 25 an.armored.space.station (206.214.251.49) 63.095 ms 62.905 ms 65.614 ms 26 with.enough.power.to (206.214.251.54) 65.654 ms 63.630 ms 64.248 ms 27 destroy.an.entire.planet (206.214.251.57) 66.392 ms 66.425 ms 63.759 ms 28 Pursued.by.the.Empires (206.214.251.62) 63.874 ms 65.473 ms 64.433 ms 29 sinister.agents (206.214.251.65) 63.987 ms 63.978 ms 64.188 ms 30 Princess.Leia.races.home (206.214.251.70) 64.206 ms 64.750 ms 64.826 ms S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 21 / 23

  22. Discussion Current Status Work in Progress: MILCOM paper in submission Change deception granularity to be configurable on a per source and destination prefix Exploring potential deployment in OpenFlow/SDN S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 22 / 23

  23. Discussion Future Work Future Work: Maintain consistency with multiple network ingresses Faking load-balancing Realistic latency distribution Supporting UDP and TCP-based traceroute Preventing detection of deception Applicability to DARPA’s “moving target defense” strategy? Thanks! Questions? S. Trassare et al. (NPS) A Technique for Network Topology Deception NPS Topo Mtg 23 / 23

Recommend

1 Ring Topology Ring Topology In a ring network, every device has exactly two neighbours

1 Ring Topology Ring Topology In a ring network, every device has exactly two neighbours

What is a Topology? Network topologies describe the ways in which the elements of a network are mapped. They describe the physical and logical arrangement of the network nodes. The physical topology of a network refers to the

279 views • 4 slides
ALM API for Topology Management ALM API for Topology Management and Network Layer Transparent

ALM API for Topology Management ALM API for Topology Management and Network Layer Transparent

ALM API for Topology Management ALM API for Topology Management and Network Layer Transparent Multimedia Transport <draft lim irtf sam alm api 00.txt > p 71 ST IETF SAM RG MEETING, PHILADELPHIA. Lim Boon Ping

231 views • 19 slides
WHAT DO WE KNOW ABOUT THE TOPOLOGY? WHAT DO WE KNOW ABOUT THE TOPOLOGY? Number of nodes and

WHAT DO WE KNOW ABOUT THE TOPOLOGY? WHAT DO WE KNOW ABOUT THE TOPOLOGY? Number of nodes and

TxProbe: Discovering Bitcoins Network Topology Using Orphan Transactions Sergi Delgado-Segura , Surya Bakshi, Cristina Prez-Sol, James Litton, Andrew Pachulski, Andrew Miller and Bobby Bhattacharjee sr_gi WHAT DO WE KNOW ABOUT THE TOPOLOGY?

1.84k views • 162 slides
Deception and Estimation: Deception and Estimation: How We Fool Ourselves How We Fool Ourselves

Deception and Estimation: Deception and Estimation: How We Fool Ourselves How We Fool Ourselves

T18 Concurrent Session Thursday 06/12/2008 3:00 PM 4:30 PM Deception and Estimation: Deception and Estimation: How We Fool Ourselves How We Fool Ourselves Presented by: Linda Rising Independent Consultant Presented at: Better Software

303 views • 29 slides
Lying and Deception in Games Joel Sobel August 2, 2016 Lying and Deception Sobel What is the

Lying and Deception in Games Joel Sobel August 2, 2016 Lying and Deception Sobel What is the

Lying and Deception in Games Joel Sobel August 2, 2016 Lying and Deception Sobel What is the Talk About? Definitions: 1. Lying 2. Deception 3. Bluff and simple properties. Lying and Deception Sobel Why do this? 1. Coherence 2. To

659 views • 47 slides
The effects of disruption and topology on the computer network packet delivery ukasz

The effects of disruption and topology on the computer network packet delivery ukasz

The effects of disruption and topology on the computer network packet delivery ukasz Makowski Supervisor : Marc X. Makkes Networks Active field of research. Finding the dependencies between : Network noise Topology

383 views • 24 slides
PNNI - Private Network to Network Interface Principles Topology concepts Routing

PNNI - Private Network to Network Interface Principles Topology concepts Routing

PNNI - Private Network to Network Interface Principles Topology concepts Routing Protocols Topology aggregation Call setup and routing algorithm 6-1 S38.121/RKa s-01 Private-Network-to-Network Interface (PNNI) is ment

609 views • 15 slides
PNNI Private Network to Network Interface Principles Topology concepts Routing Protocols

PNNI Private Network to Network Interface Principles Topology concepts Routing Protocols

PNNI Private Network to Network Interface Principles Topology concepts Routing Protocols Topology aggregation Call setup and routing algorithm PNNI-1 S-38.121 / S-04 / RKa, NB ATM background ATM = Asynchronous Transfer Mode

500 views • 17 slides
Skydive An analyzer for network topology and traffic Sylvain Baubeau Sylvain Afchain Skydive

Skydive An analyzer for network topology and traffic Sylvain Baubeau Sylvain Afchain Skydive

Skydive An analyzer for network topology and traffic Sylvain Baubeau Sylvain Afchain Skydive goals Topology exploration and visualization Network traffic capture Make network troubleshooting easier SDN agnostic Real-time

704 views • 10 slides
Topology monitoring implementation of network management system in TWAREN hybrid network

Topology monitoring implementation of network management system in TWAREN hybrid network

Topology monitoring implementation of network management system in TWAREN hybrid network National Center for High-Performance Computing 1 ABSTRACT TWAREN (TaiWan Advanced Research and Education Network) is a hybrid network composed of

532 views • 16 slides
WHAT DO WE KNOW ABOUT THE TOPOLOGY? WHAT DO WE KNOW ABOUT THE TOPOLOGY? Number of nodes and

WHAT DO WE KNOW ABOUT THE TOPOLOGY? WHAT DO WE KNOW ABOUT THE TOPOLOGY? Number of nodes and

# SFBW19 TxProbe: Discovering Bitcoins Network Topology Using Orphan Transactions Sergi Delgado-Segura , Surya Bakshi, Cristina Prez-Sol, James Litton, Andrew Pachulski, Andrew Miller and Bobby Bhattacharjee sr_gi WHAT DO WE KNOW ABOUT THE

1.96k views • 168 slides
NETWORK LAYER INTERNET TOPOLOGY CONSTRUCTION M. Engin Tozal & Kamil Sarac The University of

NETWORK LAYER INTERNET TOPOLOGY CONSTRUCTION M. Engin Tozal & Kamil Sarac The University of

1 NETWORK LAYER INTERNET TOPOLOGY CONSTRUCTION M. Engin Tozal & Kamil Sarac The University of Texas at Dallas AGENDA 2 Internet Topology and its Representation Existing Topology Representations Subnet Level Topologies

594 views • 38 slides
Module 15: Network Structures Background Topology Network Types Communication

Module 15: Network Structures Background Topology Network Types Communication

Module 15: Network Structures Background Topology Network Types Communication Communication Protocol Robustness Design Strategies Operating System Concepts Silberschatz, Galvin and Gagne 2002 15.1 A Distributed

378 views • 16 slides
Network Topology JOHNNY JACOBS Networks as Graphs Simplified abstraction Intuitive

Network Topology JOHNNY JACOBS Networks as Graphs Simplified abstraction Intuitive

Network Topology JOHNNY JACOBS Networks as Graphs Simplified abstraction Intuitive Nodes are hosts, routers, switches Edges are connections Allows simulation Convenient Cost effective What is Topology? Generally

353 views • 21 slides
Neural Network Meets DCN: Traffic-driven Topology Adaptation with Deep Learning Moewi Wang, Yong

Neural Network Meets DCN: Traffic-driven Topology Adaptation with Deep Learning Moewi Wang, Yong

Neural Network Meets DCN: Traffic-driven Topology Adaptation with Deep Learning Moewi Wang, Yong Cui, Shihan Xiao, Xin wang, Dan Yang, Kai Chen, Jun Zhu Introduction Conventional wired data centers generally adopt a static network topology

338 views • 14 slides
Network Topology Inference Gonzalo Mateos Dept. of ECE and Goergen Institute for Data Science

Network Topology Inference Gonzalo Mateos Dept. of ECE and Goergen Institute for Data Science

Network Topology Inference Gonzalo Mateos Dept. of ECE and Goergen Institute for Data Science University of Rochester gmateosb@ece.rochester.edu http://www.ece.rochester.edu/~gmateosb/ April 9, 2019 Network Science Analytics Network Topology

1.51k views • 65 slides
On Deception and Defection Jason Quinley Chris Ahern University of Tbingen, University of

On Deception and Defection Jason Quinley Chris Ahern University of Tbingen, University of

Cooperation and Deception Beggars and Signals Face and Other-Regarding Preferences Further Examples and Discussion On Deception and Defection Jason Quinley Chris Ahern University of Tbingen, University of Pennsylvania August 7, 2012

732 views • 50 slides
WANWide Area Network. The internet at large, the outside. LANLocal Area

WANWide Area Network. The internet at large, the outside. LANLocal Area

Typical Network Topology SOHO Firewalls WAN 2006-11-25 (Internet) What is it: Networks and Firewalls / Routers firewall/ DMZ router Typical Network Topology LAN LAN LAN WANWide Area Network. The internet at large, the

624 views • 6 slides
Paper Swords I Timothy 4:1-8 The Deception of Demon-Doctrines The deadliest form of evil to

Paper Swords I Timothy 4:1-8 The Deception of Demon-Doctrines The deadliest form of evil to

Paper Swords I Timothy 4:1-8 The Deception of Demon-Doctrines The deadliest form of evil to beware of, is that which has the appearance of good. deception: appears to lead you toward holiness, but eventually leads you astray demon-possession :

394 views • 6 slides
Stata Center Network Infrastructure Outline Introduction Physical topology overview Network

Stata Center Network Infrastructure Outline Introduction Physical topology overview Network

Stata Center Network Infrastructure Outline Introduction Physical topology overview Network design strategy Summary of specific requirements Proposal expectations/timeline Q&A Stata Center Network Infrastructure Introduction The Ray

604 views • 24 slides
Large-Scale Network Topology Emulation and Inference Erik Rye Naval Postgraduate School

Large-Scale Network Topology Emulation and Inference Erik Rye Naval Postgraduate School

Large-Scale Network Topology Emulation and Inference Erik Rye Naval Postgraduate School Monterey, CA 31 March 2015 1 / 22 Outline 1 Motivation and Methodology Motivation Emulated Router Inference Kit 2 Results An example topology Example

726 views • 24 slides
Topology Discovery Correlating different network topology layers in heterogeneous environments

Topology Discovery Correlating different network topology layers in heterogeneous environments

Topology Discovery Correlating different network topology layers in heterogeneous environments Diederik Vandevenne Dennis Pellikaan February 8, 2013 Diederik Vandevenne, Dennis Pellikaan Topology Discovery February 8, 2013 1 / 13

314 views • 13 slides
Multiple Source Multiple Destination Topology Inference Destination Topology Inference using

Multiple Source Multiple Destination Topology Inference Destination Topology Inference using

Multiple Source Multiple Destination Topology Inference Destination Topology Inference using Network Coding Pegah Sattari EECS, UC Irvine Joint work with Athina Markopoulou, at UCI, Christina Fragouli at EPFL Lausanne Christina Fragouli,

503 views • 36 slides
Grid5000 network topology use cases Aur elien CEDEYN Pascale PRIMET INRIA Laboratoire de

Grid5000 network topology use cases Aur elien CEDEYN Pascale PRIMET INRIA Laboratoire de

Grid5000 network topology use cases Aur elien CEDEYN Pascale PRIMET INRIA Laboratoire de lInformatique du Parall elisme/RESO FRANCE October 15, 2007 Aur elien CEDEYN Pascale PRIMET (INRIA) Grid5000 network topology use

928 views • 66 slides

More recommend