Middlebox Detection: Evasion and Effectiveness
Vahab Pournaghshband, Hassan Pournaghshband, Eric Vance · 2024
Network middleboxes are crucial for the security and efficiency of modern Internet infrastructure, performing various tasks that necessitate robust detection and localization tools. Traditional detection strategies often overlook the adaptability of these middleboxes, which can actively avoid detection. To address this, our paper examines how adversaries can manipulate network traffic to undermine detection tools, focusing on strict priority queueing (SPQ) as an example. We introduce an adversary model that uses SPQ to mask discriminatory traffic handling from detection tools. Simulations show that under specific conditions, a middlebox can successfully evade detection by standard SPQ detection tools.