Abstract:Border Gateway Protocol (BGP) plays a critical role in the Internet inter-domain routing reliability. Invalid routes generated by mis-configurations or forged by malicious attacks may hijack the traffic and devastate the Internet routing system, but it is unlikely that a secure BGP can be deployed in the near future to completely prevent them. Although many hijacking detection systems have been developed, they more or less have weaknesses such as long detection delay, high false alarm rate and deployment difficulty, and no systematic detection results have been studied. This paper proposes Argus, an agile system that can accurately detect prefix hijackings and deduce the underlying cause of route anomalies in a very fast way. Argus is based on correlating the control and data plane information closely and pervasively, and has been continuously monitoring the Internet for more than one year. During this period, around 40K routing anomalies were detected, from which 220 stable prefix hijackings were identified. Our analysis on these events shows that, hijackings that have only been theoretically studied before do exist in the Internet. Although the frequency of new hijackings is nearly stable, more specific prefixes are hijacked more frequently. Around 20% of the hijackings last less than ten minutes, and some can pollute 90% of the Internet in less than two minutes. These characteristics make \emph{Argus} especially useful in practice. We further analyze some representative cases in detail to help increase the understanding of prefix hijackings in the Internet.

Evaluation of Prefix Hijacking Impact Based on Hinge-Transmit Property of BGP Routing System.

A study of hinge-transmit property of BGP routing system

Analysis on the Effect of Prefix Hijacking Attack and Internet Hierarchy.

Whom to Convince? It Really Matters in BGP Prefix Hijacking Attack and Defense

Analysis of prefix hijacking based on AS hierarchical model

The Power of Prefix Hijackings in the Internet Hierarchy

Inter-domain Routing Bottlenecks and Their Aggravation

Detecting Prefix Hijackings in the Internet with Argus

Research on AS Path Betweenness Based Filtering Policy Against BGP Prefix Hijacking

Be Careful of Your Neighbors: Injected Sub-Prefix Hijacking Invisible to Public Monitors.

On Evaluating BGP Routing Stress Attack.

Study on Ip Prefix Hijacking in Cloud Computing Networks Based on Attack Planning

Study on BGP Security

Argus: An accurate and agile system to detecting IP prefix hijacking

Evaluating Trustworthiness of Prefix Announcements in Internet Routing

Safeguarding Against Active Routing Attack Via Online Learning

BGP with BGPsec: Attacks and Countermeasures

On the Classification and False Alarm of Invalid Prefixes in RPKI Based BGP Route Origin Validation

Assessing the Impact of Cascading Failures on the Interdomain Routing System of the Internet

Assessing Survivability of Inter-domain Routing System under Cascading Failures

A Threat Perception Method for Inter-Domain Routing Systems Based on Weighted Similarity