1. A LIGHT-WEIGHT DISTRIBUTED SCHEME FOR DETECTING IP PREFIX HIJACKS IN REAL TIME Changxi Zheng, Lusheng Ji, Dan Pei, Jia Wang and Paul Francis. Cornell University, Ithaca, NY SIGCOMM’07

2. Outline  Prefix Hijacking  Problem  Related Work  Solution  Evaluation  Summary

3. Prefix Hijacking  IP Prefix Hijacking is the process of taking over of groups of IP addresses by corrupting the routing tables  An Autonomous System (AS) is a collection of connected IP routing prefixes under the control of one or more network operators (ISP ? ). Routing tables between ASes are maintained using the BGP

4. Problem  Today’s Internet has no authentication mechanisms for routing announcements  Prefix Hijacks:  Blackholing  Imposture  Interception

5. Related Work  Crypto-based solutions require BGP to sign & verify the origin AS [Requires Public Key Infrastructure]  Non-Crypto solutions require changing router softwares so that inter-AS queries are supported

6. Solution – Monitoring Network Location

7. Solution - Detecting Path Disagreement Original Legitimate Route change (Load Balancing, congestion … etc) Prefix Hijacking

8. Evaluation  Detection Accuracy  Detection Latency ( avg. 6.06 ~ 7.38 measurements)  No automatic detection for sub-prefix hijacks  Hop count measurements are countered by manually modifying TTL values

9. Summary  The proposed scheme:  Light-weight  Highly accurate in hijack detection  Real-time detection  Easily deployed ( no network configuration changes, no PK required, no router software changes)