A LIGHT-WEIGHT DISTRIBUTED SCHEME FOR DETECTING IP PREFIX HIJACKS IN REAL TIME Changxi Zheng, Lusheng Ji, Dan Pei, Jia Wang and Paul Francis. Cornell University, Ithaca, NY SIGCOMM’07

Outline  Prefix Hijacking  Problem  Related Work  Solution  Evaluation  Summary

Prefix Hijacking  IP Prefix Hijacking is the process of taking over of groups of IP addresses by corrupting the routing tables  An Autonomous System (AS) is a collection of connected IP routing prefixes under the control of one or more network operators (ISP ? ). Routing tables between ASes are maintained using the BGP

Problem  Today’s Internet has no authentication mechanisms for routing announcements  Prefix Hijacks:  Blackholing  Imposture  Interception

Related Work  Crypto-based solutions require BGP to sign & verify the origin AS [Requires Public Key Infrastructure]  Non-Crypto solutions require changing router softwares so that inter-AS queries are supported

Solution – Monitoring Network Location

Solution - Detecting Path Disagreement Original Legitimate Route change (Load Balancing, congestion … etc) Prefix Hijacking

Evaluation  Detection Accuracy  Detection Latency ( avg ~ 7.38 measurements)  No automatic detection for sub-prefix hijacks  Hop count measurements are countered by manually modifying TTL values

Summary  The proposed scheme:  Light-weight  Highly accurate in hijack detection  Real-time detection  Easily deployed ( no network configuration changes, no PK required, no router software changes)