A Taxonomy of Attacks Using BGP Blackholing

Miller, Loïc; Pelsser, Cristel

doi:10.1007/978-3-030-29959-0_6

Cited by 12 publications

(13 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We would like to investigate BGP blackholing activity on other BGP collectors, specifically at the looking glasses 56 . We would also like to investigate the misusage of BGP blackholing service 57 . Moreover, we are trying other machine learning algorithms and working on other classification features (such as prefix length and next‐hop attribute) to produce more improved classification models for BGP blackholing detection.…”

Section: Discussionmentioning

confidence: 99%

Detecting and analyzing border gateway protocol blackholing activity

Farasat

Khan

2020

Int J Network Mgmt

View full text Add to dashboard Cite

Summary DDoS attack is a traditional malicious attempt to make an authorized system or service inaccessible. Currently, BGP blackholing is an operational countermeasure that builds upon the capabilities of BGP to protect from DDoS attacks. BGP enables blackholing by leveraging the BGP community attribute. This paper presents the analysis of BGP blackholing activity and propose a machine learning‐based mechanism to detect BGP blackholing activity. In BGP blackholing analysis, we find that many networks, including Internet service providers (ISPs) and Internet exchange points (IXPs), offer BGP blackholing service to their customers. We collect networks' blackhole communities and make BGP blackhole communities dictionary. Within 3‐month period (from August to October, 2018), we find a significant number of BGP blackhole announcements (97,532) and distinct blackhole prefixes (8,120). Most of the blackhole prefixes are IPv4 (99.1%). Among IPv4 blackhole prefixes, mostly are /32 (79.9%). The daily patterns of BGP blackholing highlight that there is a variable number of blackhole announcements and distinct blackhole prefixes every day. Furthermore, we apply machine learning techniques to design a BGP blackholing detection mechanism based on support vector machine (SVM), decision tree, and long short‐term memory (LSTM) classifiers. The results are compared based on accuracy and F‐score. Experimental results show that LSTM achieves the best classification accuracy of 95.9% and F‐score of 97.2%. This work provides insights for network operators and researchers interested in BGP blackholing service and DDoS mitigation in the Internet.

show abstract

Section: Discussionmentioning

confidence: 99%

Detecting and analyzing border gateway protocol blackholing activity

Farasat

Khan

2020

Int J Network Mgmt

View full text Add to dashboard Cite

show abstract

“…Miller and Pelsser [36] try to classify the attack that happened in BGP by using the Nlacholing technique in the BGP to mitigate DDoS attacks. The autonomous system (AS) is the part in which the internet consists of single or multiple networks controlled by one entity.…”

Section: Drdos Attacks Based On Tcp Protocolmentioning

confidence: 99%

Distributed reflection denial of service attack: A critical review

Nuiaa

Manickam

Alsaeedi

2021

IJECE

View full text Add to dashboard Cite

As the world becomes increasingly connected and the number of users grows exponentially and “things” go online, the prospect of cyberspace becoming a significant target for cybercriminals is a reality. Any host or device that is exposed on the internet is a prime target for cyberattacks. A denial-of-service (DoS) attack is accountable for the majority of these cyberattacks. Although various solutions have been proposed by researchers to mitigate this issue, cybercriminals always adapt their attack approach to circumvent countermeasures. One of the modified DoS attacks is known as distributed reflection denial-of-service attack (DRDoS). This type of attack is considered to be a more severe variant of the DoS attack and can be conducted in transmission control protocol (TCP) and user datagram protocol (UDP). However, this attack is not effective in the TCP protocol due to the three-way handshake approach that prevents this type of attack from passing through the network layer to the upper layers in the network stack. On the other hand, UDP is a connectionless protocol, so most of these DRDoS attacks pass through UDP. This study aims to examine and identify the differences between TCP-based and UDP-based DRDoS attacks.

show abstract

“…There are different ways to perform a hijack and their impact may vary. Below, we present a taxonomy of hijacks [9], [16] and discuss their impact characteristics. Origin-AS (Type-0) or Fake-path (Type-N, N ≥ 1) hijack.…”

Section: B Hijack Types and Impact Characteristicsmentioning

confidence: 99%

Estimating the Impact of BGP Prefix Hijacking

Sermpezis¹,

Kotronis²,

Arakadakis³

et al. 2021

Preprint

View full text Add to dashboard Cite

BGP prefix hijacking is a critical threat to the resilience and security of communications in the Internet. While several mechanisms have been proposed to prevent, detect or mitigate hijacking events, it has not been studied how to accurately quantify the impact of an ongoing hijack. When detecting a hijack, existing methods do not estimate how many networks in the Internet are affected (before and/or after its mitigation).In this paper, we study fundamental and practical aspects of the problem of estimating the impact of an ongoing hijack through network measurements. We derive analytical results for the involved trade-offs and limits, and investigate the performance of different measurement approaches (control/data-plane measurements) and use of public measurement infrastructure. Our findings provide useful insights for the design of accurate hijack impact estimation methodologies. Based on these insights, we design (i) a lightweight and practical estimation methodology that employs ping measurements, and (ii) an estimator that employs public infrastructure measurements and eliminates correlations between them to improve the accuracy. We validate the proposed methodologies and findings against results from hijacking experiments we conduct in the real Internet.

show abstract

A Taxonomy of Attacks Using BGP Blackholing

Cited by 12 publications

References 38 publications

Detecting and analyzing border gateway protocol blackholing activity

Detecting and analyzing border gateway protocol blackholing activity

Distributed reflection denial of service attack: A critical review

Estimating the Impact of BGP Prefix Hijacking

Contact Info

Product

Resources

About