Bloom Filter Optimization for Spoofing Attack Detection

TCP protokol je ranjiv na napade tipa SYN poplava i jedan od efikasnih načina obrane je Bloom filter. Bloom filteri su efikasne strukture podataka koje služe za pohranu velike količine podataka u mali memorijski prostor i omogućavaju brze provjere pripadnosti. S brojećim Bloom filterima možemo detektirati tip IP lažiranja koji se koristi u napadu SYN poplavom. Uz pomoć algoritama koji koriste proširivi Bloom filteri možemo učinkovito filtrirati lažan SYN promet prilikom korištenja podmrežnog ili fiksnog lažiranja, a kod napada s pseudo slučajnim lažiranjem koristimo standardni Bloom filter za spremanje liste pouzdanih IP adresa.TCP protocol is vulnerable to SYN flood type attacks and an effective defence method is the Bloom filter. Bloom filters are efficient data structures that store large amounts of data in a small storage space and allow for quick membership queries. With use of counting Bloom filter, we can detect type of IP spoofing that is used in SYN flood attack. Scalable Bloom filter can be utilized for filtering spoofed SYN traffic if the attacker uses random or subnet spoofing. When attacker uses fixed IP spoofing we use standard Bloom filter for storing whitelist of trusted IP addresses