1. A method of detecting spoofed Internet Protocol (IP) traffic directed to a network having a plurality of interfaces, comprising: creating a mapping table indicating correlations between IP address prefixes and AS numbers by processing routing information from a plurality of data sources; for each interface, acquiring IP address prefixes from a training traffic flow entering the interface; converting the IP address prefixes into AS numbers based on the mapping table; and generating an interface expected AS number table for the interface based on the AS numbers; and determining if an operational traffic flow is allowed to enter the network based on the interface expected AS number table.