Incompetents, criminals, or spies: Macroeconomic analysis of routing anomalies

Moriano, Pablo; Achar, Soumya; Camp, L. Jean

doi:10.1016/j.cose.2017.06.011

Cited by 5 publications

(2 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Routing anomalies caused by both misconfigurations and malicious intent have tested the resilience of Internet core protocols [40]. Here, we propose an anomaly detection method and show that it would identify three large scale anomalies significantly in advance when compared with the state-ofthe-art method [54].…”

Section: Discussionmentioning

confidence: 99%

Using Bursty Announcements for Detecting BGP Routing Anomalies

Moriano,

Hill,

Camp

2019

Preprint

Self Cite

View full text Add to dashboard Cite

Despite the robust structure of the Internet, it is still susceptible to disruptive routing updates that prevent network traffic from reaching its destination. In this work, we propose a method for early detection of large-scale disruptions based on the analysis of bursty BGP announcements. We hypothesize that the occurrence of large-scale disruptions is preceded by bursty announcements. Our method is grounded in analysis of changes in the inter-arrival times of announcements. BGP announcements that are associated with disruptive updates tend to occur in groups of relatively high frequency, followed by periods of infrequent activity. To test our hypothesis, we quantify the burstiness of inter-arrival times around the date and times of three large-scale incidents: the Indosat hijacking event in April 2014, the Telecom Malaysia leak in June 2015, and the Bharti Airtel Ltd. hijack in November 2015. We show that we can detect these events several hours prior to when they were originally detected. We propose an algorithm that leverages the burstiness of disruptive updates to provide early detection of large-scale malicious incidents using local collector data. We describe limitations, open challenges, and how this method can be used for large-scale routing anomaly detection.

show abstract

Section: Discussionmentioning

confidence: 99%

Using Bursty Announcements for Detecting BGP Routing Anomalies

Moriano,

Hill,

Camp

2019

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…We have included networks and autonomous systems in our assessment of third-party dependencies in access paths due to the increasing relevance of BGPrelated security issues [26,27,28]. Indeed, BGP attacks have occurred even in application scenarios different from the web [29] and others have proven to be feasible [30,31].…”

Section: Motivations and Related Workmentioning

confidence: 99%