ProBGP: Progressive Visual Analytics of Live BGP Updates

Abstract

The global routing network is the backbone of the Internet. However, it is quite vulnerable to attacks that cause major disruptions or routing manipulations. Prior related works have visualized routing path changes with node link diagrams, but it requires strong domain expertise to understand if a routing change between autonomous systems is suspicious. Geographic visualization has an advantage over conventional node‐link diagrams by helping uncover such suspicious routes as the user can immediately see if a path is the shortest path to the target or an unreasonable detour. In this paper, we present ProBGP, a web‐based progressive approach to visually analyze BGP update routes. We created a novel progressive data processing algorithm for the geographic approximation of autonomous systems and combined it with a progressively updating visualization. While the newest log data is continuously loaded, our approach also allows querying the entire log recordings since 1999. We present the usefulness of our approach with a real use case of a major route leak from June 2019. We report on multiple interviews with domain experts throughout the development. Finally, we evaluated our algorithm quantitatively against a public peering database and qualitatively against AS network maps.

The State of the Art in BGP Visualization Tools: A Mapping of Visualization Techniques to Cyberattack Types

“…In general, BGP visualization tools are intended for expert users or users with strong domain knowledge. Ulmer et al, for example, define the primary target users of their tool as administrators and prefix owners, with regulators, ISPs, and Internet exchange point (IXP) Managers as secondary users [77]. Additionally, Di Donato et al focuses on network operators [22].…”

“…However, Papadopoulos et al note that "not all the ASes have a publicly known country of origin" [55]. On the other hand, Ulmer et al argue the advantages of geographic visualizations over conventional node-link diagrams [77] and, how the additional location information helps to distinguish suspicious behavior from an unintended misconfiguration [76]. However, there is an alternate opinion that there is not great meaning in geographic distances versus those that can be represented in a node-link graph.…”

“…Researchers have developed several BGP visualization tools to aid expert users in identifying, analyzing and understanding BGP attacks and anomalies. For example, well-known and publicly available tools such as BGPlay 1 [14], and more recently Upstream Visibility [9] and ProBGP [77], have been designed for use by network operators, researchers, and law enforcement. However, there has been less BGP visualization tool development than one might expect given how fundamental BGP is to the internet, as well as its historically-unresolved security issues.…”

Cybersecurity visualization design approaches: toward connecting research and practice through technique, context, and process

“…In general, BGP visualization tools are intended for expert users or users with strong domain knowledge. Ulmer et al, for example, define the primary target users of their tool as administrators and prefix owners, with regulators, ISPs, and Internet exchange point (IXP) Managers as secondary users [76]. Additionally, Di Donato et al focuses on network operators [21].…”

“…Researchers have developed several BGP visualization tools to aid expert users in identifying, analyzing and understanding BGP attacks and anomalies. For example, well-known and publicly available tools such as BGPlay 1 [14], and more recently Upstream Visibility [8] and ProBGP [76], have been designed for use by network operators, researchers, and law enforcement. However, there has been less BGP visualization tool development than one might expect given how fundamental BGP is to the internet, as well as its historically-unresolved security issues.…”