Accurate Real-time Identification of IP Prefix Hijacking

DMCA

Accurate Real-time Identification of IP Prefix Hijacking

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Xin Hu , Z. Morley Mao

Citations:

59 - 2 self

BibTeX

@MISC{Hu_accuratereal-time,
    author = {Xin Hu and Z. Morley Mao},
    title = {Accurate Real-time Identification of IP Prefix Hijacking},
    year = {}
}

OpenURL

Abstract

We present novel and practical techniques to accurately detect IP prefix hijacking attacks in real time to facilitate mitigation. Attacks may hijack victim’s address space to disrupt network services or perpetrate malicious activities such as spamming and DoS attacks without disclosing identity. We propose novel ways to significantly improve the detection accuracy by combining analysis of passively collected BGP routing updates with data plane fingerprints of suspicious prefixes. The key insight is to use data plane information in the form of edge network fingerprinting to disambiguate suspect IP hijacking incidences based on routing anomaly detection. Conflicts in data plane fingerprints provide much more definitive evidence of successful IP prefix hijacking. Utilizing multiple real-time BGP feeds, we demonstrate the ability of our system to distinguish between legitimate routing changes and actual attacks. Strong correlation with addresses that originate spam emails from a spam honeypot confirms the accuracy of our techniques.

Keyphrases

accurate real-time identification ip prefix hijacking data plane fingerprint practical technique actual attack network service ip prefix successful ip prefix hijacking spam email detection accuracy definitive evidence victim address space real time strong correlation suspicious prefix edge network novel way malicious activity key insight multiple real-time bgp feed data plane information spam honeypot do attack anomaly detection legitimate routing change suspect ip hijacking incidence

DMCA