Detecting prefix hijackings in the internet with argus

Shi, Xingang; Yang, Xiang; Wang, Zhiliang; Yin, Xia; Wu, Jianping

doi:10.1145/2398776.2398779

Cited by 99 publications

(87 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Taking this sort of attack into account is challenging as it requires realtime access to interdomain routing data and intelligent analysis to identify incidents that may impact the safety of the client's path. In the future, we plan to integrate subscriptions to BGP hijack data sources (e.g., Argus [36], or ongoing efforts at building a real-time interception detector [12]) into Astoria to allow it to operate on dynamic BGP paths.…”

Section: Security Against Network-level Attackersmentioning

confidence: 99%

Measuring and Mitigating AS-level Adversaries Against Tor

Nithyanand

Starov

Zair

et al. 2016

Proceedings 2016 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

The popularity of Tor as an anonymity system has made it a popular target for a variety of attacks. We focus on traffic correlation attacks, which are no longer solely in the realm of academic research with recent revelations about the NSA and GCHQ actively working to implement them in practice.Our first contribution is an empirical study that allows us to gain a high fidelity snapshot of the threat of traffic correlation attacks in the wild. We find that up to 40% of all circuits created by Tor are vulnerable to attacks by traffic correlation from Autonomous System (AS)-level adversaries, 42% from colluding AS-level adversaries, and 85% from statelevel adversaries. In addition, we find that in some regions (notably, China and Iran) there exist many cases where over 95% of all possible circuits are vulnerable to correlation attacks, emphasizing the need for AS-aware relay-selection.To mitigate the threat of such attacks, we build Astoria-an AS-aware Tor client. Astoria leverages recent developments in network measurement to perform path-prediction and intelligent relay selection. Astoria reduces the number of vulnerable circuits to 2% against AS-level adversaries, under 5% against colluding AS-level adversaries, and 25% against state-level adversaries. In addition, Astoria load balances across the Tor network so as to not overload any set of relays.

show abstract

Section: Security Against Network-level Attackersmentioning

confidence: 99%

Measuring and Mitigating AS-level Adversaries Against Tor

Nithyanand

Starov

Zair

et al. 2016

Proceedings 2016 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Using multiple sources gives also the possibility to benefit from the large number of vantage points they have around the globe. This is important, because a hijacking might affect only a part of the Internet, due to BGP policies and shortest-path routing [12,24].…”

Section: Prefix Hijacking Detection With Artemismentioning

confidence: 99%

“…Since shortest route paths are typically preferred, only a part of the Internet that is closer to the hijacker (in number of AS-hops) switches to route paths towards the hijacker. Exact prefix hijacks typically infect a few tens or hundreds of ASes [12], from small stub networks to large tier-1 ISPs [24]. In our experiments, the legitimate AS announces the prefix 184.…”

Section: Types Of Prefix Hijacking Attackmentioning

confidence: 99%

“…In our experiments, the legitimate AS announces the prefix 184. 164 Sub-prefix hijacking contributes around 10% of all stable hijackings in the Internet [12]. The hijacker announces a more specific prefix, which is covered by the prefix of the legitimate AS.…”

Section: Types Of Prefix Hijacking Attackmentioning

confidence: 99%

“…A number of systems have been proposed for detecting prefix hijacking, based on control plane (i.e., BGP data) and/or data plane (i.e,. pings/traceroutes) information [12][13][14][15][16][17][18]. Most of them, are designed to operate as third-party services (external to an AS) that monitor the Internet, and upon the detection of a suspicious incident, notify the involved ASes.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Artemis

Chaviaras¹,

Gigis²,

Sermpezis³

et al. 2016

Proceedings of the 2016 ACM SIGCOMM Conference

View full text Add to dashboard Cite

The Border Gateway Protocol (BGP) is globally used by Autonomous Systems (ASes) to establish route paths for IP prefixes in the Internet. Due to the lack of authentication in BGP, an AS can hijack IP prefixes owned by other ASes (i.e., announce illegitimate route paths), impacting thus the Internet routing system and economy. To this end, a number of hijacking detection systems have been proposed. However, existing systems are usually third party services that -inherently-introduce a significant delay between the hijacking detection (by the service) and its mitigation (by the network administrators). To overcome this shortcoming, in this paper, we propose ARTEMIS, a tool that enables an AS to timely detect hijacks on its own prefixes, and automatically proceed to mitigation actions. To evaluate the performance of ARTEMIS, we conduct real hijacking experiments. To our best knowledge, it is the first time that a hijacking detection/mitigation system is evaluated through extensive experiments in the real Internet. Our results (a) show that ARTEMIS can detect (mitigate) a hijack within a few seconds (minutes) after it has been launched, and (b) demonstrate the efficiency of the different control-plane sources used by ARTEMIS, towards monitoring routing changes.

show abstract

A Taxonomy of Attacks Using BGP Blackholing

Miller

Pelsser

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Detecting prefix hijackings in the internet with argus

Cited by 99 publications

References 19 publications

Measuring and Mitigating AS-level Adversaries Against Tor

Measuring and Mitigating AS-level Adversaries Against Tor

Artemis

A Taxonomy of Attacks Using BGP Blackholing

Contact Info

Product

Resources

About