Jelena Mirkovic's guest appearances

Jelena Mirkovic

CERIAS Weekly Security Seminar - Purdue University

Immigrant Computer Scientists

Ryan Henry

Cory Doctorow

Doug Smith

Larry Ponemon

Moshe Vardi

George Heron

Laura Thomas

Eli Lilly

Stephen Elliott

Tony Sager

David Carroll

Jack Daniel

Joe Judge

Chris Reed

Richard III

OwlTail

Episode 3. Interview with Jelena Mirkovic, Research Associate Professor at University of Southern California and Information Sciences Institute (ISI). Leader in the security and networking field, and in building the well-known DeterLab testbed. Immigrant from Yugoslavia to the US for her PhD in 1998, went to high school and university in Belgrade during the Yugoslav Wars of the 1990s.

Episode 3. Interview with Jelena Mirkovic, Research Associate Professor at University of Southern California and Information Sciences Institute (ISI). Leader in the security and networking field, and in building the well-known DeterLab testbed. Immigrant from Yugoslavia to the US for her PhD in 1998, went to high school and university in Belgrade during the Yugoslav Wars of the 1990s.

Jelena Mirkovic Interview

IP spoofing accompanies many malicious activities and is even means for performing reflector DDoS attacks. Route-based filtering (RBF) enables a router to filter spoofed packets based on their incoming interface - this information is stored in an incoming table. Packets arriving on the expected incoming interface for their source address are considered legitimate, while all the other packets are filtered as spoofed. Past research has shown that RBF can be very effective when deployed at the vertex cover of the Internet AS-map (about 1500 ASes) but no practical approach has been proposed for incoming table construction.We first show that RBF achieves high effectiveness even if the number of deploying points is very small (30 chosen deployment points reduce the amount of the spoofed Internet traffic to 5%). We further show that completeness of the incoming tables is critical for filtering effectiveness - partially full tables are as good as empty. This implies that routers cannot rely on reports of a few participating domains to build their incoming tables, but instead must devise means of accurately "guessing" incoming interface information for all traffic they see. Their guessing strategy must quickly react to offending traffic and determine with high accuracy whether the reason for the offense was a route change (in which case incoming interface information must be updated) or spoofing.We next propose a protocol called Clouseau which builds accurate incoming tables at RBF routers, and keeps these tables up to date in face of frequent route changes. Clouseau infers incoming table information by applying randomized drops to offending TCP traffic and observing its retransmission behavior. No communication is required with packet sources or other RBF routers, which makes Clouseau suitable for partial deployment. The inference process is further resilient to subversion by an attacker who is familiar with the design of Clouseau. About the speaker: Jelena Mirkovic received her B.Sc at University of Belgrade, Serbia and Montenegro in 1998 and her MS and PhD at UCLA in 2000 and 2003.Since 2003, she joined University of Delaware as an assistant professor.Her research investigates distributed denial-of-service detection and defense, IP spoofing and Internet worms, and is supported by NSF and the Department of Homeland Security.---------------------------------------------------------------------------  

IP spoofing accompanies many malicious activities and is even means for performing reflector DDoS attacks. Route-based filtering (RBF) enables a router to filter spoofed packets based on their incoming interface - this information is stored in an incoming table. Packets arriving on the expected incoming interface for their source address are considered legitimate, while all the other packets are filtered as spoofed. Past research has shown that RBF can be very effective when deployed at the vertex cover of the Internet AS-map (about 1500 ASes) but no practical approach has been proposed for incoming table construction. We first show that RBF achieves high effectiveness even if the number of deploying points is very small (30 chosen deployment points reduce the amount of the spoofed Internet traffic to 5%). We further show that completeness of the incoming tables is critical for filtering effectiveness - partially full tables are as good as empty. This implies that routers cannot rely on reports of a few participating domains to build their incoming tables, but instead must devise means of accurately "guessing" incoming interface information for all traffic they see. Their guessing strategy must quickly react to offending traffic and determine with high accuracy whether the reason for the offense was a route change (in which case incoming interface information must be updated) or spoofing. We next propose a protocol called Clouseau which builds accurate incoming tables at RBF routers, and keeps these tables up to date in face of frequent route changes. Clouseau infers incoming table information by applying randomized drops to offending TCP traffic and observing its retransmission behavior. No communication is required with packet sources or other RBF routers, which makes Clouseau suitable for partial deployment. The inference process is further resilient to subversion by an attacker who is familiar with the design of Clouseau. About the speaker: Jelena Mirkovic received her <a href="http://B.Sc" rel="nofollow" target="_blank">B.Sc</a> at University of Belgrade, Serbia and Montenegro in 1998 and her MS and PhD at UCLA in 2000 and 2003. Since 2003, she joined University of Delaware as an assistant professor. Her research investigates distributed denial-of-service detection and defense, IP spoofing and Internet worms, and is supported by NSF and the Department of Homeland Security. ---------------------------------------------------------------------------

Jelena Mirkovic, Clouseau: A practical IP spoofing defense through route-based filtering