Detection of Internet‐wide traffic redirection attacks using machine learning techniques

Abstract

Internet‐wide traffic redirection attacks have been reported for long, and are mainly caused by Border Gateway Protocol route hijacking. Such attacks can be quite harmful, impairing access to popular Internet sites for long periods. This work addresses the use of machine learning techniques (both unsupervised and supervised) leveraging from a distributed monitoring infrastructure of probes that measure the round trip time to Internet sites under surveillance. The detection process is separated into two stages: per‐probe classification and a combination of individual probe decisions. Our results show that the best strategy is to classify using an unsupervised technique based on Tukey's method and to combine using Hidden Markov Models, due to its performance and adaptability to different attack types.