Anzeige
Erschienen in:
2019 | OriginalPaper | Buchkapitel
Client Side Localization of BGP Hijack Attacks with a Quasi-realistic Internet Graph
verfasst von : Paulo Salvador
Erschienen in: E-Business and Telecommunications
Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.
Wählen Sie Textabschnitte aus um mit Künstlicher Intelligenz passenden Patente zu finden. powered by
Markieren Sie Textabschnitte, um KI-gestützt weitere passende Inhalte zu finden. powered by
Abstract
Internet routing relies completely on the Border Gateway Protocol (BGP) which is inherently insecure and allow the deployment of route hijacking attacks. The client side detection of such type of attacks can be achieved by detecting Round Trip Time (RTT) deviations from multiple points on the Internet to the target network. However, the localization of the autonomous systems where the attack originates can only be performed with an underlying realistic and precise model of the Internet interconnections. A usable and useful realistic Internet interconnections model does not exist. The existing interconnection models are to simplistic to be applicable in real scenarios and/or incorporate to much uncorrelated information that cannot be used due to its complexity.
This work presents a client side methodology to locate the source of BGP hijack attacks based on a quasi-realist graph that models the Internet as an all. The construction of such graph builds upon all known Internet exchange points (IX) and landing points of all known submarine cables. The lack of information about interconnections between Internet exchangers (IX) nodes and landing points is extrapolated from simple rules that take in consideration Earth geographic characteristics. This approach results in a graph that includes all major corner stones of the Internet while maintaining a simple structure. This underlying quasi-realist graph model of the Internet will allow the search for IX nodes where a false route could be injected to create a similar RTT anomaly observed during an attack.
With very simplistic assumptions as similar node, link loads and symmetric routing by the shortest path, and calibration using a relatively small set of world-scale measurements, the proof-of-concept results show that the model allows to locate the source of routing hijack attacks within a reasonable degree of efficiency.