Network gateway spoofing detection and mitigation
Endpoint security systems and methods include a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by a network gateway system based on time-to-live (TTL) information from the received packet. A machine learning model is configured to estimate an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances. A spoof detection module is configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security module is configured to perform a security action at the network gateway system responsive to the determination that the received packet has a spoofed source IP address.
1. An endpoint security system implemented in a network gateway system, comprising:
a hardware processor; and
a memory, configured to store computer program code that, when executed by the hardware processor, performs a security action, the computer program code including:
distance estimation code that calculates a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by the network gateway system based on time-to-live (TTL) information from the received packet;
spoof detection code that determines structural correspondences between the source IP address and one or more known source IP addresses, that splits the source IP address into at least a beginning portion and an end portion, that pads the beginning portion and the end portion to form a normalized source IP address, that estimates an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances, using a machine learning model, and that determines that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance; and
security code that performs a security action at the network gateway system responsive to the determination that the received packet has a spoofed source IP address.
2. The system of claim 1 , wherein the spoof detection code further provides the source IP address and the target network endpoint system IP address to a neural network, where an activation function for neurons in the neural network is determined as:
f
i
=
{
i
=
1
softsign
(
w
d
×
256
i
=
0
×
B
256
×
1
i
=
0
+
b
d
×
1
i
=
0
)
i
∈
{
1
,
…
,
n
}
softsign
(
w
d
×
(
256
+
d
)
i
∈
{
1
,
…
,
n
}
×
concat
(
B
256
×
1
i
∈
{
1
,
…
,
n
}
,
f
d
×
1
i
-
1
)
+
b
d
×
1
i
∈
{
1
,
…
,
n
}
)
where i is a layer of the neural network, w d×256 i is a set of weights, d is a dimension of a final IP representation, B 256×1 i=0 is a byte value from a normalized IP address, b d×1 i is a set of biases, and n is a number of bytes in the normalized IP address.
3. The system of claim 1 , wherein the computer program product further includes training code that trains a neural network to estimate distances between an input source IP address and an input destination IP address based on training data that comprises a sparse matrix of distances between known source IP addresses and destination IP addresses.
4. The system of claim 1 , wherein the distance estimation code further finds a difference between the TTL information from the received packet and a default initial TTL value.
5. The system of claim 1 , wherein the spoof detection code further determines a difference between the calculated travel distance and the expected travel distance and comparing the determined difference to a threshold value.
6. The system of claim 1 , wherein the security action comprises at least one action selected from the group consisting of blocking traffic from the source IP address of the received packet, changing a system security policy, changing a packet filtering setting on an upstream device, discarding the packet, and performing deep packet inspection.
7. The system of claim 1 , wherein the machine learning model is a neural network model.
8. A method for mitigating a spoofing-based attack at a network gateway, comprising:
calculating a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by a network gateway system based on time-to-live (TTL) information from the received packet;
estimating an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances, by determining structural correspondences between the source IP address and one or more known source IP addresses, including splitting the source IP address into at least a beginning portion and an end portion, and padding the beginning portion and the end portion to form a normalized source IP address;
determining that the received packet has a spoofed source IP address using a processor based on a comparison between the calculated travel distance and the expected travel distance; and
performing a security action at the network gateway system, responsive to the determination that the received packet has a spoofed source IP address.
9. The method of claim 8 , wherein estimating the expected travel distance comprises providing the source IP address and the target network endpoint system IP address to a neural network, where an activation function for neurons in the neural network is determined as:
f
i
=
{
i
=
1
softsign
(
w
d
×
256
i
=
0
×
B
256
×
1
i
=
0
+
b
d
×
1
i
=
0
)
i
∈
{
1
,
…
,
n
}
softsign
(
w
d
×
(
256
+
d
)
i
∈
{
1
,
…
,
n
}
×
concat
(
B
256
×
1
i
∈
{
1
,
…
,
n
}
,
f
d
×
1
i
-
1
)
+
b
d
×
1
{
i
∈
1
,
…
,
n
}
)
where i is a layer of the neural network, w d×256 i is a set of weights, d is a dimension of a final IP representation, B 256×1 i=0 is a byte value from a normalized IP address, b d×1 i is a set of biases, and n is a number of bytes in the normalized IP address.
10. The method of claim 8 , further comprising training a neural network to estimate distances between an input source IP address and an input destination IP address based on training data that comprises a sparse matrix of distances between known source IP addresses and destination IP addresses.
11. The method of claim 8 , wherein calculating the travel distance comprises finding a difference between the TTL information from the received packet and a default initial TTL value.
12. The method of claim 8 , wherein determining that the received packet has a spoofed source IP address comprises determining a difference between the calculated travel distance and the expected travel distance and comparing the determined difference to a threshold value.
13. The method of claim 8 , wherein performing the security action comprises at least one action selected from the group consisting of blocking traffic from the source IP address of the received packet, changing a system security policy, changing a packet filtering setting on an upstream device, discarding the packet, and performing deep packet inspection.