BGP Hijacking Detection via Autonomous System Origin Degree Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Border Gateway Protocol (BGP) is vulnerable to man-in-the-middle (MITM) attacks, where attackers can redirect traffic by announcing more specific network prefixes, leading to unauthorized data inspection or alteration, which existing methods fail to detect effectively.
Innovation Solution
An automated method using BGP data from internal and external sources to analyze the connectedness of each autonomous system in an AS-path, calculating a suspicion score based on origin degrees to identify suspicious or hijacked paths, thereby detecting BGP hijacking and mistaken announcements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If BGP routing messages are used to announce network prefixes, then traffic routing is enabled, but the system becomes vulnerable to MITM attacks and AS-path forgeries
Solution Approach 1:
The system performs preliminary analysis of AS-path connectedness before traffic routing decisions are made. By pre-calculating and storing connectedness metrics for autonomous systems, the system can quickly detect suspicious routing announcements without interfering with normal BGP operations. This preliminary preparation enables real-time detection of MITM attacks while maintaining efficient traffic routing.
Solution Approach 2:
The system implements continuous monitoring and feedback mechanisms that analyze BGP routing messages against established connectedness baselines. When anomalies are detected in AS-path announcements, the system provides feedback to identify potential attacks. This feedback loop enables dynamic detection and response to routing threats while preserving legitimate traffic flow.
2Measurement precision
If existing detection methods are used, then some routing anomalies may be identified, but BGP hijacking and mistaken announcements are not detected effectively
Solution Approach 1:
The system replaces traditional rule-based detection mechanisms with a data-driven approach using connectedness analysis. Instead of relying on static routing policies or simple anomaly thresholds, the system uses dynamic connectedness metrics derived from historical BGP data to establish baselines. This substitution enables more reliable detection of BGP hijacking by comparing actual routing paths against statistically derived expected behavior.
Solution Approach 2:
The system transforms the detection approach by changing from fixed threshold-based parameters to dynamic connectedness parameters. By calculating origin degrees and connectedness scores that adapt to changing network conditions, the system achieves both high precision in identifying anomalies and high reliability in detecting actual hijacking events. The parameter transformation enables differentiation between benign routing changes and malicious activities.
3Reliability
If connectedness analysis is performed on all AS-paths, then suspicious paths can be detected, but computational complexity and processing time increase
Solution Approach 1:
The system segments the AS-path analysis into discrete, manageable components by evaluating connectedness at each individual AS hop rather than analyzing entire paths simultaneously. This segmentation allows parallel processing of multiple ASes and enables incremental calculation of connectedness metrics. By breaking down the complex path analysis into atomic operations, the system achieves reliable detection without overwhelming computational complexity.
Solution Approach 2:
The system performs connectedness analysis selectively on AS-paths that exhibit certain characteristics or deviations from expected patterns, rather than uniformly analyzing all paths. By applying analysis only where needed based on preliminary filtering criteria, the system maintains high detection reliability for suspicious paths while reducing overall computational burden. This partial action approach optimizes the balance between detection thoroughness and processing efficiency.
Data Source
AI summary
A system includes a memory to store instructions and an autonomous system path (AS-path) and a processor. The processor executes instructions in the memory to determine an origin degree for each autonomous system in the AS-path, compare the origin degree of a first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path, and sum percentage increase values determined by comparing the origin degree of the first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path to determine a suspicion score for the AS-path.