An internet routing forensics framework for discovering rules of abnormal BGP events

Computer Communication Review

Volumn 35, Issue 5, 2005, Pages 55-66

  Li, Jun ^a   Dou, Dejing ^a   Wu, Zhen ^a   Kim, Shiwoong ^a   Agarwal, Vikash ^a  

^a UNIVERSITY OF OREGON   (United States)

Author keywords

Abnormal BGP events; Blackout; Data mining; Internet worms; Routing forensics

Indexed keywords

ABNORMAL BGP EVENTS; BLACKOUT; INTERNET WORMS; ROUTING FORENSICS;

COMPUTER SIMULATION; COMPUTER WORMS; DATA MINING; INTERNET; ROUTERS;

COMPUTER ARCHITECTURE;

EID: 33847257039     PISSN: 01464833     EISSN: 01464833     Source Type: Conference Proceeding    
DOI: 10.1145/1096536.1096542     Document Type: Conference Paper

References (34)

1. Hurricane frances chronology. http://www.fpl.com/storm/contents/ hurricane_frances.chronology.shtml.
2. RIPE routing information service raw data, http://data.ris.ripe.net/.
3. R. Agrawal and R. Skrikant. Fast algorithms for mining association rules. In Proceedings of 1994 VLDB Conference, pages 487-499, 1994.
4. W. Aiello, J. Ioannidis, and P. McDaniel. Origin authentication in interdomain routing. In Proceedings of the ACM Conference on Computer and Communication Security (CCS), 2003.
5. D. Barbar, J. Couto, S. Jajodia, and N. Wu. Adam: A testbed for exploring the use of data mining in intrusion detection. SIGMOD Record, 2001.
6. S. Convery, D. Cook, and M. Franz. An attack tree for the Border Gateway Protocol. Internet Draft, September 2003. Work in progress.
7. J. Cowie, A. Ogielski, B. Premore, E. Smith, and T. Underwood. Impact of the 2003 blackouts on Internet communications. Technical report, Renesys, November 2003.
8. J. Cowie, A. Ogielski, B. Premore, and Y. Yuan. Global routing instabilities during Code Red II and Nimda worm propagation. Technical report, Renesys, 2001.
9. J. Cowie, A. Ogielski, B. Premore, and Y. Yuan. Internet worms and global routing instabilities. In Proceedings of SPIE International symposium on Convergence of IT and Communication, 2002.
10. J. Fartar. C&W routing instability. http://www.merit.edu/mail. archives/ nanog/2001-04/msg00209.html.
11. G. Goodell, W. Aiello, T. Griffin, J. Ioannidis, P. McDaniel, and A. Rubin. Working around BGP: An incremental approach to improving security and accuracy of interdomain routing. In Proceedings of Network and Distributed System Security Symposium (NDSS), February 2003.
12. J. Han and M. Kamber. Data Mining: Concepts and Techniques. Morgan Kaufmann Publishers, 2001.
13. S. Kent, C. Lynn, and K. Seo. Secure Border Gateway Protocol (S-BGP). In Proceedings of Network and Distributed Systems Security Symposium, 2000.
14. C. Kruegel, D. Mutz, W. Robertson, and F. Valeur. Topology-based detection of anomalous BGP messages. In Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID), September 2003.
15. C. Labovitz, G. Malan, and F. Jahanian. Internet routing instability. IEEE/ACM Transactions on Networking, 6(5):515-528, 1998.
16. M. Lad, X. Zhao, B. Zhang, D. Massey, and L. Zhang. An analysis of BGP update surge during Slammer attack. In Proceedings of the International Workshop on Distributed Computing (IWDC), 2003.
17. T. Lane and C. Brodley. Temporal sequence learning and data reduction for anomaly detection. ACM Transactions on Information and System Security, 2(3):295-331, 1999.
18. A. Lazarevic, L. Ertz, V. Kumar, A. Ozgur, and J. Srivastava. A comparative study of anomaly detection schemes in network intrusion detection. In Proceedings of SDM, 2003.
19. W. Lee, S. Stolfo, and K. Mok. Mining in a data-flow environment: Experience in network intrusion detection. In Proceedings of the International Conference on Knowledge Discovery and Data Mining (KDD), 1999.
20. J. Li, J. Mirkovic, M. Wang, P. L. Reiher, and L. Zhang. SAVE: Source address validity enforcement protocol. In Proceedings of IEEE INFOCOM, 2002.
21. R. Mahajan, D. Wetherall, and T. Anderson. Understanding BGP misconfiguration. In Proceedings of ACM SIGCOMM, August 2002.
22. S. Misel. Wow, AS7007! http://www.merit.edu/mail.archives/nanog/1997-04/ msg00340.html.
23. G. Mohay, A. Anderson, B. Collie, and R. M. O. Vel. Computer and Intrusion Forensics. Computer Security Series. Artech House Publishers, 2003.
24. S. Murphy. BGP security vulnerabilities analysis. Internet Draft, June 2003. Work in progress.
25. J. Quinlan. C4.5: Programs for Machine Learning. Morgan Kaufmann Publishers, 1993.
26. S. Savage, D. Wetherall, A. Karlin, and T. Anderson. Practical network support for IP traceback. In Proceedings of ACM SIGCOMM, 2000.
27. E. Schultz and R. Shumway. Incident Response: A Strategic Guide to Handling System and Network Security Breaches. New Riders, 2002.
28. A. Snoeren, C. Partridge, L. Sanchez, C. Jones, F. Tchakountio, S. Kent, and W. Strayer. Hash-based IP traceback. In Proceedings of ACM SIGCOMM, August 2002.
29. S. Teoh, K. Ma, S. Wu, D. Massey, X. Zhao, D. Pei, L. Wang, L. Zhang, and R. Bush. Visual-based anomaly detection for BGP origin AS change (OASC) events. In Proceedings of the Distributed Systems, Operations, and Management Workshop, 2003.
30. University of Oregon Route Views Project, http://ante.uoregon.edu/route- views/.
31. L. Wang, X. Zhao, D. Pei, R. Bush, D. Massey, A. Mankin, S. Wu, and L. Zhang. Observation and analysis of BGP behavior under stress. In Proceedings of Internet Measurement Workshop, November 2002.
32. Z. Wu, E. S. Purpus, and J. Li. BGP behavior analysis during the August 2003 blackout. In International Symposium on Integrated Network Management, 2005. extended abstract.
33. K. Zhang, A. Yen, S. Wu, L. Zhang, X. Zhao, and D. Massey. On detection of anomalous routing dynamics in BGP. In Proceedings of the International IFIP-TC6 Networking Conference, 2004.
34. X. Zhao, D. Pei, L. Wang, D. Massey, A. Mankin, S. Wu, and L. Zhang. Detection of invalid routing announcement in the Internet. In Proceedings of International Conference on Dependable Systems and Networks (DSN'02), 2002.