# US 12,603,917 B2 · Systems and methods for IP spoofing security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,917 B2 - Document ID: US12603917B2 - Status: Granted - Kind: B2 - Application number: 17/657,381 - Filed: 2022-03-31 - Published: 2022-10-13 - Granted: 2026-04-14 - Earliest claimed: 2021-04-09 - Assignees: CenturyLink Intellectual Property LLC - Applicants: CenturyLink Intellectual Property LLC - Inventors: Dean Ballew; John R.B. Woodworth; John A. Schiel - Web page: https://patentgrep.com/patent/US12603917B2 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Examples of the present disclosure describe systems and methods for providing security against IP spoofing. In aspects, network traffic associated with one or more data requests may be received by a device in a computing environment. The network traffic may be evaluated using one or more automated logic systems or algorithms to identify suspicious or malicious behavior. The automated logic systems or algorithms may implement one or more analyses, such as asymmetric routing analysis, hardware device analysis, user and/or network behavior analysis, etc. Upon identifying suspicious or malicious behavior, the automated logic systems or algorithms may apply a filter to one or more computing devices. For example, a filter for blocking network traffic associated with the suspicious or malicious behavior may be applied to a computing device that is in close geographic and/or logical proximity to an attacking computing device. ## Claims ### Claim 1 A system comprising: at least one processor; and memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising: receiving, at a receiving device, network traffic information from a sending device, wherein the network traffic information comprises a source IP address; evaluating the network traffic information to determine the source IP address is being used illegitimately; in response to determining the source IP address is being used illegitimately: identifying at least one ingress router of a network receiving network traffic that identifies the source IP address; determining at least one transmission path within the network for the network traffic; ranking multiple devices along the transmission path based on closest proximity of the filter device to the ingress router, wherein the closest proximity is a combination of geographical proximity to the receiving device and logical proximity to the receiving device; and identifying a filter device based at least on the ranking; and applying a filter to the filter device, wherein the filter is configured to block at least a portion of the network traffic information from the sending device. ### Claim 2 (depends on 1) The system of claim 1, wherein the filter device comprises an edge device of a network that includes the receiving device, wherein the filter device comprises, or operates in conjunction with, an ingress router for the network. ### Claim 3 (depends on 1) The system of claim 1, wherein the network traffic information comprises data from IP packets addressed to a destination device, and wherein the filter device comprises a device that is different from both the receiving device and the destination device. ### Claim 4 (depends on 2) The system of claim 2, wherein identifying the filter device comprises determining that the filter device includes sufficient processing capability to apply the filter. ### Claim 5 (depends on 4) The system of claim 4, wherein the network comprises multiple intermediate devices between the ingress router and the destination device that include sufficient processing capability to apply the filter. ### Claim 6 (depends on 1) The system of claim 1, wherein the method further comprises determining, for the IP packet, an expected egress router, wherein the network traffic information comprises an IP packet and the network traffic information comprises identification of both the ingress router and an actual egress router for the IP packet, and wherein evaluating the network traffic information to determine the source IP address is being used illegitimately comprises determining that network traffic is being asymmetrically routed. ### Claim 7 (depends on 6) The system of claim 6, wherein evaluating the network traffic information to determine the source IP address is being used illegitimately comprises determining that network traffic is being asymmetrically routed is further based on detecting an increase in the network traffic exceeding a threshold. ### Claim 8 (depends on 1) The system of claim 1, wherein evaluating the network traffic information to determine the source IP address is being used illegitimately comprises determining that the source IP address is associated with a geographic location inconsistent with an expected geographic location based on a location of the receiving device. ### Claim 9 (depends on 1) The system of claim 1, wherein evaluating the network traffic information to determine the source IP address is being used illegitimately comprises determining that the network traffic information indicates network traffic that is anomalous based on the source IP address and historical behavioral data, wherein historical behavioral data comprises a measure of network traffic based on both time and location for the source IP address. ### Claim 10 (depends on 1) The system claim 1, wherein the method further comprises ranking multiple devices in a transmission path for network traffic based on at least proximity to the ingress router and processing capability of the multiple devices, wherein the filter device comprises one of the ranked multiple devices. ### Claim 11 A method, comprising: receiving, at a receiving device, network traffic information from a sending device, wherein the network traffic information comprises a source IP address; evaluating the network traffic information to determine the source IP address is being used illegitimately; in response to determining the source IP address is being used illegitimately: identifying at least one ingress router of a network receiving network traffic that identifies the source IP address; determining at least one transmission path within the network for the network traffic; ranking multiple devices along the transmission path based on closest proximity of the filter device to the ingress router, wherein the closest proximity is a combination of geographical proximity to the receiving device and logical proximity to the receiving device; identifying a filter device based at least on the ranking; and applying a filter to the filter device, wherein the filter is configured to block at least a portion of the network traffic. ### Claim 12 (depends on 11) The method of claim 11, wherein the filter device comprises an edge device of a network that includes the receiving device, wherein the filter device comprises, or operates in conjunction with, an ingress router for the network. ### Claim 13 (depends on 11) The method of claim 11, wherein the network traffic information comprises data from IP packets addressed to a destination device, and wherein the filter device comprises a device that is different from both the receiving device and the destination device. ### Claim 14 (depends on 12) The method of claim 12, wherein identifying the filter device comprises determining that the filter device includes sufficient processing capability to apply the filter. ### Claim 15 (depends on 14) The method of claim 14, wherein the network comprises multiple intermediate devices between the ingress router and the destination device that include sufficient processing capability to apply the filter, further comprising ranking multiple devices in a transmission path for network traffic based on at least proximity to the ingress router and processing capability of the multiple devices, wherein the filter device comprises one of the ranked multiple devices. ### Claim 16 (depends on 11) The method of claim 11, further comprising determining, for the IP packet, an expected egress router, wherein the network traffic information comprises an IP packet and the network traffic information comprises identification of both the ingress router and an actual egress router for the IP packet, and wherein evaluating the network traffic information to determine the source IP address is being used illegitimately comprises determining that network traffic is being asymmetrically routed. ### Claim 17 (depends on 16) The method of claim 16, wherein evaluating the network traffic information to determine the source IP address is being used illegitimately comprises determining that network traffic is being asymmetrically routed is further based on detecting an increase in the network traffic exceeding a threshold. ### Claim 18 (depends on 11) The method of claim 11, wherein evaluating the network traffic information to determine the source IP address is being used illegitimately comprises determining that the network traffic information indicates network traffic that is anomalous based on the source IP address and historical behavioral data, wherein historical behavioral data comprises a measure of network traffic based on both time and location for the source IP address. ### Claim 19 (depends on 11) The method of claim 11, further comprising ranking multiple devices in a transmission path for network traffic based on at least proximity to the ingress router and processing capability of the multiple devices, wherein the filter device comprises one of the ranked multiple devices.