EZ-SAVE: Evaluation of Easy-to-Deploy Source Address Validation Policies
summary
Evaluates easy-to-deploy SAV policies with a modified BGPI simulator on realistic KADA topology and RIPE/RouteViews measurements, running 1,000 trials per scenario and varying adoption 0–99%. Finds BAR-SAV delivers the best tradeoff: high spoof-detection and low false positives, requiring only the legitimate origin to publish an ASPA to eliminate false alarms; under heavy traffic-engineering scenarios other RFC-based methods suffer up to 60% false positives (and BAR-SAV peaks near 13%) unless ROAs/ASPAs are used.
AI-written summary · about
chapters (10)
- 0:00EZ-SAVE and IP spoofing
- 1:22Easy-to-deploy SAV policies
- 3:10Enhanced URPF and BARSAV policies
- 5:17Traffic engineering methods
- 7:48Simulation setup and attacker models
- 9:13Results with traffic engineering
- 10:17Impact on false positives
- 11:43False positives without export
- 12:26Direct server return with BARSAV
- 13:29Summary and Q&A
related talks
40mISE-Skating: Lessons Learned in Bypassing Network Access Control
09mSecurity-driven SDV in SOAFEE
18mAPKeep: Realtime Verification for Real Networks
47mRSAC Security Scholar Poster Pitch-Off
21mStealth BGP Hijacks with uRPF Filtering
54mOvercoming The Inundation Of Noisy Security Alerts
15mUnsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety...
15mFrom Address Blocks to Authorized Prefixes: Redesigning RPKI ROV with a Hierarchical...