Security of Networks and Services in an All-Connected World

Abstract

With a vastly different header format, IPv6 introduces new vulnerabilities not possible in IPv4, potentially requiring new detection algorithms. While many attacks specific to IPv6 have proven to be pos-sible and are described in the literature, no detection solutions for these attacks have been proposed. In this study we identify and characterise IPv6-specific attacks that can be detected using flow monitoring. By con-structing flow-based signatures, detection can be performed using avail-able technologies such as NetFlow and IPFIX. To validate our approach, we implemented these signatures in a prototype, monitoring two produc-tion networks and injecting attacks into the production traffic.