Prefix Hijacking Detection via Data Plane Path Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting prefix hijacking attacks in the Internet's BGP routing protocol are ineffective due to high false alarm rates from route anomalies, requiring additional analysis and filtering, and are slow to react, as they often cannot accurately distinguish between hijacking attacks and legitimate route changes.
Innovation Solution
The solution involves determining an end-to-end path and a reference node path between a source node and a destination network, comparing these paths to detect prefix hijacking attacks by identifying when the reference node path is not a sub-path of the end-to-end path, and generating an alarm for detected attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control plane data is used to detect prefix hijacking attacks, then routing inconsistencies can be discovered, but false alarms are generated from route anomalies caused by network operators
Solution Approach 1:
The patent introduces data plane traffic flow information as an intermediary to verify routing announcements. Instead of relying solely on control plane BGP data, the system uses actual observed traffic flows as a mediator to confirm whether routing announcements are legitimate, thereby reducing false alarms from route anomalies.
Solution Approach 2:
The system implements feedback by continuously monitoring data plane traffic flows and comparing them against control plane routing announcements. This feedback mechanism allows the system to identify and filter out false alarms by verifying whether announced routes actually carry corresponding traffic flows.
2Reliability
If control plane data monitoring is implemented, then routing anomalies can be detected, but the system is slow to react and requires additional analysis and filtering
Solution Approach 1:
The patent performs preliminary action by continuously monitoring and baseline-ing data plane traffic flows before attacks occur. This pre-established baseline of legitimate traffic patterns enables the system to quickly detect deviations indicating prefix hijacking attacks without requiring time-consuming analysis and filtering after the fact.
Solution Approach 2:
The system maintains continuous monitoring of both control plane routing announcements and data plane traffic flows simultaneously. This continuous dual-plane monitoring ensures that attack detection is immediate and ongoing, eliminating delays associated with periodic sampling or post-event analysis.
3Difficulty of detecting and measuring
If control plane data solutions are used, then routing inconsistencies can be identified, but additional analysis and filtering are required to handle false positives
Solution Approach 1:
The patent merges control plane monitoring with data plane traffic flow analysis into a unified detection system. By combining these two planes, the system automatically cross-validates routing announcements against actual traffic, eliminating the need for separate complex analysis and filtering processes to handle false positives.
Solution Approach 2:
The system implements self-service by using its own collected data plane traffic flow information to automatically verify and filter control plane routing announcements. This self-verification mechanism eliminates the need for external analysis and filtering processes, as the system uses its own operational data to validate routing legitimacy.
Data Source
AI summary
Disclosed is a method and apparatus for detecting prefix hijacking attacks. A source node is separated from a destination network at a first time via an original path. The destination network is associated with a prefix. At a second time, a packet is transmitted from the source node to the destination network to determine a current path between the source node and the destination network. A packet is also transmitted from the source node to a reference node to determine a reference node path. The reference node is located along the original path and is associated with a prefix different than the prefix associated with the destination network. The current path and the reference node path are then compared, and a prefix hijacking attack is detected when the reference node path is not a sub-path of the current path.