Argus: An accurate and agile system to detecting IP prefix hijacking

Yang, Xiang; Wang, Zhiliang; Yin, Xia; Wu, Jianping

doi:10.1109/icnp.2011.6089080

Cited by 13 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This part of work is inspired by other previous researches [24,25]. Finally, the routing anomaly monitoring module in our scheme builds on a lot of control-plane based hijacking detection proposals [16,32,33].…”

Section: Related Workmentioning

confidence: 96%

“…Moreover, recent studies [11,12] indicated that even in the case of full deployment, there are some forms of prefix interception attacks that the cryptographic schemes cannot prevent. (2) For the detection proposals [13][14][15][16], they often identify prefix hijacking by discovering anomalous BGP routes (control plane) and black holes (data plane). However, prefix interception cannot also be detected by those methods.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An accurate distributed scheme for detection of prefix interception

Duan

Wang

et al. 2016

Sci. China Inf. Sci.

Self Cite

View full text Add to dashboard Cite

Previous research in interdomain routing security has often focused on prefix hijacking. However, several prefix interception events have happened lately, which poses a new security challenge to the interdomain routing system. Compared to prefix hijacking, prefix interception is much harder to detect, as it avoids black hole by forwarding the hijacked traffic back to the victim. In this paper, we present a novel method to detect prefix interception. Our approach exploits a key observation about prefix interception: during a prefix interception event, the attacker detours the intercepted traffic through its network, which turns it into a new important "transit point" for access to the victim. By collecting data plane information to detect the emerging "transit point" and using control plane information to verify it, our scheme can identify prefix interception in real time. The results of Internet experiments and Internet-scale simulations show that our method is accurate with low false alarm rate (0.28%) and false negative rate (2.26%).

show abstract

Section: Related Workmentioning

confidence: 96%

Section: Introductionmentioning

confidence: 99%

An accurate distributed scheme for detection of prefix interception

Duan

Wang

et al. 2016

Sci. China Inf. Sci.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Argus [36] is an agile system to detect prefix hijacking and other anomalies caused by misconfigurations or malicious attacks; this system has been collecting data since June 1, 2011. After cross checking the RouteViews data described in Section 3 and the data collected from Argus, we found that in IPv4, at least 170 036 out of 5 973 568 (2.85%) BAPLs were associated with prefix hijacking or other routing anomalies from June 1, 2011 to December 31, 2013.…”

Section: Faulty Configurations or Malicious Attacksmentioning

confidence: 99%

Measuring BGP AS path looping (BAPL) and private AS number leaking (PANL)

Zhang

Liu

Pei

et al. 2018

Tinshhua Sci. Technol.

View full text Add to dashboard Cite

As a path vector protocol, Border Gateway Protocol (BGP) messages contain an entire Autonomous System (AS) path to each destination for breaking arbitrary long AS path loops. However, after observing the global routing data from RouteViews, we find that BGP AS Path Looping (BAPL) behavior does occur and in fact can lead to multi-AS forwarding loops in both IPv4 and IPv6. The number and ratio of BAPLs in IPv4 and IPv6 on a daily basis from August 1, 2011 to August 31, 2015 are analyzed. Moreover, the distribution of BAPLs among duration and loop length in IPv4 and IPv6 are also studied. Several possible explanations for BAPL are discussed in this paper. Private AS Number Leaking (PANL) has contributed to 0.20% of BAPLs in IPv4, and at least 1.76% of BAPLs in IPv4 were attributed to faulty configurations and malicious attacks. Valid explanations, including networks of multinational companies, preventing particular AS from accepting routes, also can lead to BAPLs. Motivated by the large number of PANLs that contribute to BAPLs, we also study the number and the ratio of PANLs per day in the 1492 days. The distribution of the private AS numbers in all of the PANLs is concentrated, and most of them are located in the source of the AS paths. The majority of BAPLs resulted from PANLs endure less than one day, and the number of BAPLs which are caused by two or more leaked private ASes are much larger than that of BAPLs which are caused by one leaked private AS. We explain for this phenomenon and give some advices for the operators of ASes.

show abstract

“…Contrary to control-plane methods, dataplane approaches are able to detect any path changes in the traffic resulting in higher accuracy. However, traffic monitoring changes are mostly deployed at the AS neighborhood level and have not been proven at large-scale, i.e., they suffer from poor scalability (Xiang et al, 2011).…”

Section: Routing Securitymentioning

confidence: 99%

“…We depended upon the Argus data set for the identification of anomalies. For the purpose of collecting routing anomalous events, we compiled data over the 43 months from June 2011 to December 2014 from the Argus 4 API, as of December 20, 2015 (Xiang et al, 2011;Shi et al, 2012).…”

Section: Dependent Variablementioning

confidence: 99%