2010/06/07 by Fabio Soldo, Soldo, Fabio, Katerina Argyraki +3
Computer Science · #FOS: Computer and information sciences #Internet Traffic Analysis and Secure E-voting #Network Packet Processing and Optimization #Network Security and Intrusion Detection #Networking and Internet Architecture (cs.NI) #cs.NI
paper · pdf · doi:10.48550/arxiv.1006.1165
Conference version appeared in Infocom 2009. Journal version submitted to ToN
arxiv created 2010/06/07 · openalex publication_date 2010/06/07 · arxiv updated 2010/06/08 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
In this paper, we consider the problem of blocking malicious traffic on the Internet, via source-based filtering. In particular, we consider filtering via access control lists (ACLs): these are already available at the routers today but are a scarce resource because they are stored in the expensive ternary content addressable memory (TCAM). Aggregation (by filtering source prefixes instead of individual IP addresses) helps reduce the number of filters, but comes also at the cost of blocking legitimate traffic originating from the filtered prefixes. We show how to optimally choose which source prefixes to filter, for a variety of realistic attack scenarios and operators' policies. In each scenario, we design optimal, yet computationally efficient, algorithms. Using logs from Dshield.org, we evaluate the algorithms and demonstrate that they bring significant benefit in practice.