A Prefix Hijacking Detection Model Based on the Immune Network Theory

Abstract

The prefix hijacking problem is an urgent security issue that need to address in the Border Gateway Protocol (BGP) security research. In order to solve the problem of prefix hijacking in BGP, we propose (a) new (p)refix (h)ijacking (d)etection model based on the immune network theory in this paper, called aPHD. To be specific, aPHD uses real BGP UPDATE messages for pre-training and has the ability to detect UPDATE messages in real time after pre-training. The aPHD (1) can effectively detect prefix hijacking attacks with high accuracy; (2)is easy to deployment; and (3) has a low false positive rate and low overhead. Extensive performance evaluation shows that our solution is secure and feasible. The aPHD improved the accuracy rate by 6.2% and reduced the false positive rate by 85.7%. INDEX TERMS Immune network theory, prefix hijacking, BGP security, negative selection.

A Bio-Inspired Reaction Against Cyberattacks: AIS-Powered Optimal Countermeasures Selection

“…In fact, the AIS aim to emulate the mechanisms and behaviors observed by the immunologists in order to be applied to a particular problem [15]. After a quite complex modeling phase, AIS have been successfully applied to various fields of digital knowledge, including optimization theory [29], data analysis [30], image recognition [31], and computer security [32]. More specifically, AIS-based proposals have arisen to solve cybersecurity challenges for anomaly detection, intrusion detection, malicious process detection, scan and flood detection, and fraud detection, among others [33], [34], [35], [36] others.…”