Cooperative Detection of Internet Prefix Hijacking

10.6138/JIT.2010.11.1.04

Pei-Dong Zhu；Xin Liu；Wen-Ping Deng；Hua-Yang Cao

BGP ； Prefix hijacking ； Cooperative detection ； Source verification ； Monitoring scope

網際網路技術學刊

11卷1期（2010 / 01 / 01）

33 - 45

英文

IP prefix hijacking in the Internet remains a threat to the security of routing and network applications. It is difficult for a router or network operator to identify the spoofed announcement of prefix ownership in a timely and accurate way for the lack of complete knowledge or authentication. This paper proposes a method, called CoMonitor, for prefix hijacking detection based on cooperation among Autonomous Systems (ASes). Every participating AS exchanges self-defined prefix-to-origin mapping information with others, and they monitor local BGP updates respectively. Once a participant discovers that the origin information of a BGP route is inconsistent with the learned prefix-to-origin mapping information, it notifies related participants immediately. The self-organized overlay network can help ASes detect prefix hijacks quickly and effectively. The paper describes its architecture, mechanisms and implementation details. Its effectiveness is validated through experiments and analysis.