Spoofer or Spoofers? Estimating a Lower Bound on the Number of DRDoS Sources Using Anycast Honeypots
Networking and Internet Architecture
Summary
The authors study a type of internet attack where bad actors hide their true location by pretending to be someone else. They set up special fake internet sites around the world to catch these fake signals and use two methods to estimate how many different networks are involved in the attacks. After watching these attacks for almost a year, they found that at least 21% come from multiple places, showing attackers spread out their fake signals. This suggests fighting these attacks needs teamwork across many networks and helps guide future ways to trace attack sources.
Authors
Bernhard Degen, Bas Palinckx, Mattijs Jonker, Roland van Rijswijk-Deij, Raffaele Sommese
Abstract
DDoS attacks remain a significant threat, with distributed reflection denial-of-service (DRDoS) attacks being particularly difficult to trace back to their sources. To better understand attacker behavior and deployment patterns, we present a novel approach for estimating a lower bound on the number of networks involved in generating spoofed traffic. Our approach leverages a global deployment of anycast amplification honeypots that attract requests from topologically nearby sources. Using this infrastructure, we develop two estimators based on the set of honeypots receiving spoofed traffic and on variations in observed TTL values, while accounting for natural path instability. Analyzing 287 days of amplification attacks, we find that at least 21.0% originate from multiple network locations, indicating that attackers frequently distribute spoofing activity across networks. Our findings suggest that combating spoofing requires coordinated and distributed defenses, and inform the design of future attribution techniques.