Abnormally malicious autonomous systems and their internet connectivity

IEEE/ACM Transactions on Networking

Volumn 20, Issue 1, 2012, Pages 220-230

  Shue, Craig A ^a   Kalafut, Andrew J ^b   Gupta, Minaxi ^c  

^a OAK RIDGE NATIONAL LABORATORY   (United States)

^b GRAND VALLEY STATE UNIVERSITY   (United States)

^c INDIANA UNIVERSITY   (United States)

Author keywords

Autonomous systems (ASs); Security

Indexed keywords

AUTONOMOUS SYSTEMS; BOTNETS; CYBERCRIME; INTERNET CONNECTIVITY; IP ADDRESSS; MALICIOUS ACTIVITIES; MALICIOUS BEHAVIOR; NETWORK OPERATOR; SECURITY;

INTERNET SERVICE PROVIDERS;

INTERNET PROTOCOLS;

EID: 84857360605     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2011.2157699     Document Type: Article

References (34)

1. J. Hruska, "Bad seed ISP Atrivo cut off from rest of the Internet," 2008 Online. Available: http://arstechnica.com/security/news/ 2008/09/bad-seed-isp-atrivo-cut-off-from-rest-of-the-internet.ars
2. B. Krebs, "Major source of online scams and spams knocked offline," 2008 Online. Available: http://voices. washingtonpost.com/ securityfix/2008/11/major-source-of-online-scams-a.html
3. J. Cheng, "FTC forces hive of scum and villainy ISP offline," 2009 Online. Available: http://arstechnica.com/tech-policy/news/2009/06/ftc- forces-hive-of-scum -and-villainy-isp-offline.ars
4. "Route Views project," University of Oregon Advanced Network Technology Center, Eugene, OR Online. Available: http://www.routeviews.org/
5. "APWG," Anti-Phishing Working Group Online. Available: http://www.antiphishing.org/
6. "PhishTank," OpenDNS, San Francisco, CA Online. Available: http://www.phishtank.com/
7. "Support Intelligence, LLC," Support Intelligence, LLC, San Francisco, CA Online. Available: http://www.support-intelligence.com/
8. "SURBL," Online. Available: http://www.surbl.org/
9. "Spamhaus block list (SBL)," Spamhaus Project Online. Available: http://www.spamhaus.org/sbl/index.lasso
10. "Exploits block list (XBL)," Spamhaus Project Online. Available: http://www.spamhaus.org/xbl/index.lasso
11. "Viruswatch mailing list," NETpilot GmbH, Munich, Germany Online. Available: http://lists.clean-mx.com/cgi-bin/mailman/listinfo/viruswatch
12. "eSoft Inc.," eSoft Inc., Broomfield, CO Online. Available: http://www.esoft.com/
13. "Malware block list,"Malware Patrol Online. Available: http://www.malwarepatrol.net/lists.shtml
14. "ShadowServer Foundation," Online. Available: http://www.shadowserver.org/wiki/
15. L.Gao, "On inferring autonomous system relationships in the internet," IEEE/ACM Trans. Netw., vol. 9, no. 6, pp. 733-745, Dec. 2001. (Pubitemid 34099653)
16. G. D. Battista, M. Patrignani, and M. Pizzonia, "Computing the types of the relationships between autonomous systems," in Proc. IEEE INFOCOM, 2003, vol. 1, pp. 156-165.
17. X. Dimitropoulos, D. Krioukov, M. Fomenkov, B. Huffaker, Y. Hyun, K. C. Claffy, and G. Riley, "AS relationships: Inference and validation," Comput. Commun. Rev., vol. 37, no. 1, pp. 29-40, Jan. 2007.
18. L. Subramanian, S. Agarwal, J. Rexford, and R. H. Katz, "Characterizing the internet hierarchy from multiple vantage points," in Proc. IEEE INFOCOM, 2002, vol. 2, pp. 618-627.
19. J. Rexford, J. Wang, Z. Xiao, and Y. Zhang, "BGP routing stability of popular destinations," in Proc. ACM SIGCOMM IMW, 2002, pp. 197-202.
20. A. Feldmann, O. Maennel, Z.M. Mao, A. Berger, and B. Maggs, "Locating internet routing instabilities," in Proc. ACM SIGCOMM, 2004, pp. 205-218. (Pubitemid 40954881)
21. Z. Zhang, Y. Zhang, Y. C. Hu, and Z. M. Mao, "iSPY: Detecting IP prefix hijacking on my own," in Proc. ACM SIGCOMM, 2008, pp. 327-338.
22. Z. Zhang, Y. Zhang, Y. C. Hu, and Z. M. Mao, "Practical defenses against BGP prefix hijacking," in Proc. CoNEXT, 2007, Article no. 3.
23. S. Kent, C. Lynn, and K. Seo, "Secure border gateway protocol (S-BGP)," IEEE J. Sel. Areas Commun., vol. 18, no. 4, pp. 582-592, Apr. 2000.
24. R. White, "Securing BGP through secure origin BGP (soBGP)," Internet Protocol J., vol. 6, no. 3, pp. 15-22, 2003.
25. J. Hruska, "Spam sees big nosedive as rogue ISP McColo knocked offline," 2008 Online. Available: http://arstechnica.com/security/news/ 2008/11/spam-sees-big-nosedive-as-rogue-isp-mccoloknocked-offline.ars
26. A. Moushchuk, T. Bragin, S. Gribble, and H. Levy, "A crawler-based study of spyware on the Web," in Proc. NDSS, 2006, pp. 17-33.
27. N. Provos, P. Mavrommatis, M. Rajab, and F. Monrose, "All your iFRAMEs point to us," in Proc. USENIX Security Symp., 2008, pp. 1-15.
28. A. Ramachandran and N. Feamster, "Understanding the network-level behavior of spammers," in Proc. ACM SIGCOMM, 2006, pp. 291-302. (Pubitemid 44623735)
29. M. Konte, N. Feamster, and J. Jung, "Dynamics of online scam hosting infrastructure," in Proc. Passive Active Meas. Conf., 2009, pp. 219-228.
30. B. Stone-Gross, C. Kruegel, K. Almeroth, A. Moser, and E. Kirda, "FIRE: FInding Rogue nEtworks," in Proc. ACSAC, 2009, pp. 231-240.
31. "Know your enemy: Fast-flux service networks," The Honeynet Project, Naperville, IL, Whitepaper, Jul. 2007 Online. Available: http://www.honeynet.org/papers/ff
32. D. K. McGrath, A. Kalafut, and M. Gupta, "Phishing infrastructure fluxes all the way," IEEE Security Privacy, vol. 7, no. 5, pp. 21-28, Sep.-Oct. 2009.
33. X. Hu and Z. M. Mao, "Accurate real-time identification of IP prefix hijacking," in Proc. IEEE Symp. Security Privacy, 2007, pp. 3-17. (Pubitemid 47432512)
34. "National Council of ISACS," 2010 Online. Available: http://www.isaccouncil.org/