Decoy Router Placement Against a Smart Adversary Jacopo Cesareo, Michael Schapira, and Jennifer Rexford Princeton University

Decoy Router Decoy router along the path to decoy destination … directs traffic to the covert destination 2 client decoy destination covert destination decoy router

Decoy Router Placement Problem Given clients, destinations, and paths –Clients: {c i } –Decoy destinations: {d j } –Paths: {P ij } from client c i to decoy destination d j Select K decoy routers –Decoy routers: {r k } from a set of candidates R To maximize –# client/decoy pairs that traverse a decoy router, or –# clients traversing a decoy router for some decoy dest 3 c1c1 c2c2 c3c3 d1d1 d2d2 P 11 P 32

Initial Placement Algorithm Heuristic based on “popularity” –# of (c i, d j ) pairs traversing the router, or –# of c i traversing the router to reach some decoy dest Greedy algorithm within 2/3 of optimal –Select the most popular candidate –Remove all parties it “covers” –Recompute the popularities –Repeat until K routers are chosen Experimental results –Good coverage with relatively few decoy routers –E.g., 5-7 ASes to cover most clients c i –E.g., ASes to cover (c i, d j ) pairs 4 c1c1 c2c2 c3c3 d1d1 d2d2 P 11 P 32

A Smart Adversary Circumventing decoy routers –By picking alternate routes –… that avoid decoy routers 55 client decoy destination covert destination decoy router Adversary Path with no decoy router

New Placement Problem Cover a (client c i, decoy destination d j ) –By covering all paths available to the adversary –E.g., the interdomain path through each neighbor AS Computationally difficult –NP-hard to find an optimal solution –(We suspect) hard even to approximate well Simple greedy heuristic –If a (ci, dj) pair has n paths –… covering one path brings a value of 1/n –Rank nodes by total value (over clients, paths, dests) –… and greedily pick the highest-value nodes 6

Experiments Autonomous System (AS) level model –RouteViews measurements of interdomain routing –CAIDA inferences of AS-level relationships –Simulation of AS-level routing decisions Example experiment –Clients: all ASes located in a country (e.g., Australia) –Decoy destinations: ASes for Amazon and eBay –Candidate decoy routers: all ASes outside the country Results –Naïve vs. smart adversary –Placing decoy routers on nodes or edges –Maximizing coverage of (c, d) pairs 7

Australia Results 8

Australia clients –710 clients –5415 paths AS node placement of decoy routers –Naïve adversary: 8 nodes to cover 90% of clients –Smart adversary: 9 nodes to cover 90% of clients AS-AS edge placement of decoy routers –Naïve adversary: 13 edges to cover 90% of clients –Smart adversary: 15 edges to cover 90% of clients Important ASes –Verizon, Sprint, EdgeCast, … 9

China Results 10

China Results China clients –207 clients –1863 paths AS node placement of decoy routers –Naïve adversary: 10 nodes to cover 90% of clients –Smart adversary: 11 nodes to cover 90% of clients AS-AS edge placement of decoy routers –Naïve adversary: 15 edges to cover 90% of clients –Smart adversary: 17 edges to cover 90% of clients Important ASes –Sprint, Telecom Italia, NTT, Level3, … 11

Conclusions Smart adversary –Selects paths that avoid the decoy router –Forces “good guys” to deploy more decoy routers Placement algorithm –Heuristic for covering alternate paths –… in the presence of a smart adversary Experimental results –Requires a few extra decoy routers –… to defend against a smart adversary Future work –Wider range of client and decoy destination scenarios 12