A Comparative analysis of BGP anomaly detection and robustness algorithms

Proceedings - Cybersecurity Applications and Technology Conference for Homeland Security, CATCH 2009

Volumn , Issue , 2009, Pages 25-38

  Sriram, Kotikapaludi ^a   Borchert, Oliver ^a   Kim, Okhee ^a   Gleichmann, Patrick ^a   Montgomery, Doug ^a  

^a NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ALERT SYSTEMS; ANOMALY DETECTION; BGP MESSAGES; BORDER GATEWAY PROTOCOL; COMPARATIVE ANALYSIS; EVALUATION METHODOLOGIES; EVALUATION PLATFORMS; INTER-DOMAIN; INTERNET REGISTRIES; INTERNET ROUTING; TESTING AND EVALUATION; TRACE DATA;

GATEWAYS (COMPUTER NETWORKS); INFORMATION SERVICES; INTERNET; INTERNET PROTOCOLS; ROUTING PROTOCOLS;

ROUTING ALGORITHMS;

EID: 66249137443     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CATCH.2009.20     Document Type: Conference Paper

References (44)

1. M. Brown, T. Underwood, and E. Zmijewski, "The Day the YouTube Died: What happened and what we might do about it", MENOG 3, Kuwait April 2008 http://www.renesys.com/tech/presentations/pdf/menog3-youtube.pdf
2. YouTube Hijacking: A RIPE NCC RIS case study, RIPE News and Announcements (2008) http://www.ripe.net/news/study-youtube-hijacking.html
3. A. Pilosov and T. Kapela, "Stealing The Internet: An Internet-Scale Man In The Middle Attack", NANOG-44, Los Angeles, October 12-15, 2008. http://www.nanog.org/meetings/nanog44/presentations/ Tuesday/Kapela steal internet N44.pdf
4. "Flaw Could Cripple Entire Net", Associated Press, April 20, 2004. http://wiredvig.wired.com/news/technology/0,1282,63143,00.html
5. "NISCC Vulnerability Advisory 236929: Vulnerability Issues in TCP", April 20, 2004
6. "CERT Advisory CA-2001-09: Statistical Weaknesses in TCP/IP Initial Sequence Numbers", http://www.cert.org/advisories/CA-2001-09.html, Original date May 2001, last revised February 2005
7. NISCC (UK Govt.) Best Practices Guidelines: Border Gateway Protocol (see note 5 on pg. 8), April 2004.
8. O. Nordstrom and C. Dovrolis, "Beware of BGP attacks", SIGCOMM Computer Communications Review (2004), Vol. 34 (2), pp. 1-8
9. K. Butler, T. Farley, P. McDaniel, and J. Rexford, "A Survey of BGP Security", Technical Report TD-5UGJ33, ATT Labs - Research, April 2005. http://www.patrickmcdaniel.org/pubs/td-5ugj33.pdf
10. Kim, J., S.Y. Ko, D.M. Nicol, X.A. Dimitropoulos, G.F. Riley, "A BGP attack against traffic engineering",Proceedings of the 2004 Winter Simulation Conference, 2004
11. S.M. Bellovin and E.R Gansner, "Using Link Cuts to Attack Internet Routing", AT&T Labs Research Technical Report, http://www.research.att. com/ smb/papers/reroute.pdf
12. F. Gont, "ICMP Attacks against TCP", IETF Internet Draft, draft-gont-tcpm-icmp-attacks-03.txt, December 2004
13. S. Convery, D. Cook, and M. Franz, "An Attack Tree for Border Gateway Protocol", IETF ID, February 2004. http://ietfreport.isoc.org/ids/ draft-ietf-rpsecbgpattack-00.txt
14. G. Siganos and M. Faloutsos, "A Blueprint for Improving the Robustness of Internet Routing", 2005. http://www.cs.ucr.edu/
15. G. Siganos and M. Faloutsos, "Analyzing BGP policies: methodology and tool", IEEE Infocom, 2004
16. M. Lad, D. Massey, Y.Wu, B. Zhang and L. Zhang, "PHAS: A prefix hijack alert system", North American Network Operators Group Meeting (NANOG-38), October, 2006. http://www.nanog.org/mtg-0610/presenter-pdfs/massey. pdf
17. M. Lad, D. Massey, D. Pei, Y. Wu, B. Zhang and L. Zhang, "PHAS: A prefix hijack alert system",in Proceedings of 15th USENIX Security Symposium (USENIX Security 2006). http://www.cs.ucla.edu/mohit/cameraReady/ ladSecurity06.pdf
18. J. Karlin, S. Forrest, and J. Rexford",Pretty Good BGP and the Internet Alert Registry," NANOG 37, June 5th 2006. http://www.nanog.org/ mtg-0606/pdf/josh-karlin.pdf
19. J. Karlin, S. Forrest, and J. Rexford, "Pretty Good BGP: Improving BGP by Cautiously Adopting Routes", The 14th IEEE International Conference on Network Protocols,November 2006. http://www.cs.unm.edu/ treport/tr/06-06/ pgbgp3.pdf
20. R. Steenbergen, "What's Wrong with IRR", NANOG-44, Los Angeles, October 12-15, 2008.http://www.nanog.org/meetings/nanog44/presentations/ Tuesday/RAS irrdata N44.pdf
21. M. Karir, L. Blunk, T. White, Kevin Chan, and Pat Pannuto, "Improving the Accuracy of Routing Registry Data", NANOG-44, Los Angeles, October 12-15, 2008.http://www.nanog.org/meetings/nanog44/ presentations/ Tuesday/Karir lightning.pdf
22. M. Kosters, "ARIN Engineering Report", ARIN-22, Los Angeles, October 15-17, 2008.http://www.arin.net/meetings/minutes/ARIN XXII/PDF/friday/engineering report.pdf
23. L. Wang, X. Zhao, D. Pei, R. Bush, D. Massey, A. Mankin, S. F. Wu, and L. Zhang, "Observation and analysis of BGP behavior under stress", Proceedings of the Second ACM SIGCOMM Workshop on Internet Measurement Workshop, 2002, Marseille, France, pp. 183-195
24. S. Kent, C. Lynn, and K. Seo, "Secure Border Gateway Protocol (S-BGP)", IEEEJSAC Special Issue on Network Security, April 2000
25. J. Ng, "Extensions to BGP to Support Secure Origin BGP (soBGP)", IETF ID draft-ng-sobgp-bgp-extensions-02.txt, April 2004
26. L. Subramanian et al., "Listen and whisper: Security mechanisms for BGP", In First Symposium on Networked Systems Design and Implementation (NSDI'04), 2004
27. A. Heffernan, "Protection of BGP Sessions via the TCP MD5 Signature Option", IETF RFC 2385,August 1998
28. J. Cowie, A. Ogielski, B. Premore, and Y. Yuan, "Global Routing Instabilities during Code Red II and Nimda Worm Propagation", http://www.renesys.com/projects/bgp instability, September 2001
29. T. Griffin, "BGP Impact of SQLWorm, 1-25-2003", January 2003. http://www.research.att.com/griffin/bgp-monitor/sqlworm.html
30. Z.M. Mao, R. Govindan, G. Varghese, and R.H. Katz, "Route Flap Damping Exacerbates Internet Routing Convergence", Proceedings of ACM SIGCOMM, Pittsburg, PA, August 2002, pp. 221-233
31. G. Goth, "Fixing BGP Might Be Difficult-Or Not So Tough", IEEE Internet Computing,vol. 07, no. 3, pp. 7-9, May/June 2003
32. K. Sriram, D. Montgomery, O. Borchert, O. Kim, and R. Kuhn",Study of BGP Peering Session Attacks and Their Impacts on Routing Performance," IEEE Journal on Selected Areas in Communications: Special issue on High-Speed Network Security, Vol. 24, No. 10, October 2006, pp.1901-1915 (Pubitemid 44559603)
33. K. Sriram, D. Montgomery, O. Borchert, O. Kim, and R. Kuhn",Border Gateway Protocol (BGP): Investigation of Vulnerabilities and Simulation Studies of Attack Impacts," NIST IIP project presentation slides, October 2006. http://www.antd.nist.gov/ ksriram/BGP Security Analysis NIST Study.pdf
34. D.R. Kuhn, K. Sriram, and D. Montgomery, "Border Gateway Protocol Security", NIST Special Publication 800-54 (Guidance Document for the Telecom Industry and US Government agencies), July 2007. http://csrc.nist.gov/ publications/nistpubs/800-54/SP800-54.pdf
35. K. Sriram, D. Montgomery, O. Borchert, O. Kim, and P. Gleichmann,"Evaluation of BGP Anomaly Detection and Robustness Algorithms", Presented at the 43rd North American Network Operators Group (NANOG-43) Meeting, Brooklyn, New York, June 1-4, 2008.http://www.nanog.org/mtg- 0806/presentations/tuesday/Sriram algorithms N43.pdf
36. "Team Cymru: The Bogon Reference",http://www.teamcymru org/Services/Bogons/
37. C. Alaettinoglu et al., "Routing Policy Specification Language(RPSL)", IETF RFC 2622,June 1999
38. L. Blunk et al., "Routing Policy Specification Language next generation (RPSLng)", IETF RFC 4012, March 2005
39. C. Villamizar et al., "Routing Policy System Security", IETF RFC 2725. http://www.ietf.org/rfc/rfc2725.txt
40. Merit Network's Routing Assets Database, http://www.radb.net/about.html
41. G. Huston and G. Michaelson, "Validation of Route Origination in BGP using the Resource Certificate PKI", October 6, 2008, Work in progress, IETF SIDR Working Group, draftietf-sidr-roa-validation-01.txt.
42. Reseaux internet protocol europeens - routing information service (RIPE-RIS) project.http://www.ripe.net/ris/
43. IPv4 Heatmaps Software, The Measurement Factory, http://maps.measurement- factory.com/software/ipv4-heatmap.1.html
44. Online version of this paper with some additional details and color graphics, http://www.antd.nist.gov/ ksriram/NIST BGP-Robustness.pdf