Advanced Packet Filter Placement Strategies for Carrier-Grade IP-Networks

The deployment strategy of packet filters in large, carrier-grade IP networks has traditionally been to place filters on the administrative border of a network, where the boundaries between trusted and non-trusted network segments are well-known. In this paper, we present a refined algorithm for a more efficient packet filter placement that also incorporates interior network nodes, using a risk-based approach for the offline computation of virtual borders that are based on operator and adversary path prediction. It allows for a more flexible usage of network resources, also with respect to multi-vendor environments where operators may not be able to provide filter-capable nodes on the complete administrative border.