Neural network based spoofing detection

A method for mitigating a spoofing-based attack, comprising:

• calculating a travel distance between a source Internet Protocol (IP) address and a target IP address from a received packet based on time-to-live (TTL) information from the received packet;
• estimating an expected travel distance between the source IP address and the target IP address based on a sparse set of known source/target distances by determining structural correspondences between the source IP address and one or more known source IP addresses;
• determining that the received packet has a spoofed source IP address using a processor based on a comparison between the calculated travel distance and the expected travel distance;
• and
• performing a security action responsive to the determination that the received packet has a spoofed source IP address.

A system for mitigating a spoofing-based attack, comprising:

• a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and a target IP address from a received packet based on time-to-live (TTL) information from the received packet;
• a machine learning model configured to estimate an expected travel distance between the source IP address and the target IP address based on a sparse set of known source/target distances;
• a spoof detection module comprising a processor configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance;
• and
• a security module configured to perform a security action responsive to the determination that the received packet has a spoofed source IP address.