Mapping internet sensors with probe response attacks

摘要: Internet sensor networks, including honeypots and log analysis centers such as the SANS Storm Center, are used a tool to detect malicious traffic. For maximum effectiveness, networks publish public reports without disclosing locations, so that community can take steps counteract Maintaining anonymity is critical because if set of sensors known, attacker could avoid entirely or overwhelm with errant data. Motivated by growing use monitor traffic, we show publicly report statistics vulnerable intelligent probing determine location sensors. In particular, develop new "probe response" attack technique number optimizations for locating in currently deployed illustrate specific case study shows how would locate Center using published data from those Simulation results identity this other less than week, even under limited adversarial model. We detail vulnerabilities several current anonymization schemes demonstrate quickly efficiently discover presence sophisticated preserving methods prefix-preserving permutations Bloom filters. Finally, consider characteristics an which make it probe response attacks discuss potential countermeasures.