BGP Communities

Streibelt, Florian; Lichtblau, Franziska; Beverly, Robert; Feldmann, Anja; Pelsser, Cristel; Smaragdakis, Georgios; Bush, Randy

doi:10.1145/3278532.3278557

Cited by 30 publications

(12 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Previous works have proposed more extensive standardization as well as security improvements for BGP communities [76], but these proposals have not seen widespread adoption. Although communities are often not standardized, there are common themes in how communities are used which have been explored by previous work [53,81]. One type of communities is information communities that are added to a route by an AS to signal properties about that route (e.g., what Internet exchange the route was learned at or whether it was learned from a peer or customer).…”

Section: Bgp Communitymentioning

confidence: 99%

“…Action communities are meaningfully transited UP (from customers to providers) the Internet hierarchy, but not over (across peering links) or down (across provider-customer links). Many ASes do not accept communities from peers 3 [13,33,81]. Accepting communities from providers also works against the interest of an AS, since action communities can limit the propagation of routes (which the AS is paying its providers for).…”

Section: Bgp Communitymentioning

confidence: 99%

“…Recent work has begun to explore communities in an adversarial setting. Streibelt et al explored how an adversary can exploit remotely triggered blackholing, traffic steering, and route manipulation for adversarial purposes [80,81]. We build on this line of work and are the first to consider communities in the context of interception attacks and in strategically limiting announcement propagation for adversarial purposes.…”

Section: Bgp Communitymentioning

confidence: 99%

“…To model this, we collected three months of Route Views project (from May 2019 -July 2019) data [44] and referred to this dataset as RV dataset. We extracted 176 million BGP updates that contain communities from the RV dataset, and recorded ASes that were seen forwarding communities in a manner similar to Streibelt et al [81]. Specifically, if we observed the AS path:…”

Section: Sico Viability Without Considering Community Forwardingmentioning

confidence: 99%

“…Ultimately network operators must consider a tradeoff between allowing full community use while enabling SICO attacks, or restricting community use (including some legitimate usage) to mitigate the effects of SICO attacks. in an extreme case that ASes only propagate communities to the immediate peer the communities are targeting, i.e., community propagation would be limited to only 2 AS hops [81]. This can weaken an adversary's ability to launch attacks since it cannot influence routing at an AS that is more than two hops away.…”

Section: Potential Countermeasuresmentioning

confidence: 99%

See 4 more Smart Citations

Sico

Birge-Lee

Wang

Rexford

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

The Border Gateway Protocol (BGP) is the primary routing protocol for the Internet backbone, yet it lacks adequate security mechanisms. While simple BGP hijack attacks only involve an adversary hijacking Internet traffic destined to a victim, more complex and challenging interception attacks require that adversary intercept a victim's traffic and forward it on to the victim. If an interception attack is launched incorrectly, the adversary's attack will disrupt its route to the victim making it impossible to forward packets. To overcome these challenges, we introduce SICO attacks (Surgical Interception using COmmunities): a novel method of launching interception attacks that leverages BGP communities to scope an adversary's attack and ensure a route to the victim. We then show how SICO attacks can be targeted to specific source IP addresses for reducing attack costs. Furthermore, we ethically perform SICO attacks on the real Internet backbone to evaluate their feasibility and effectiveness. Results suggest that SICO attacks can achieve interception even when previously proposed attacks would not be feasible and outperforms them by attracting traffic from an additional 16% of Internet hosts (worst case) and 58% of Internet hosts (best case). Finally, we analyze the Internet topology to find that at least 83% of multi-homed ASes are capable of launching these attacks.

show abstract

Section: Bgp Communitymentioning

confidence: 99%

Section: Bgp Communitymentioning

confidence: 99%

Section: Bgp Communitymentioning

confidence: 99%

Section: Sico Viability Without Considering Community Forwardingmentioning

confidence: 99%

Section: Potential Countermeasuresmentioning

confidence: 99%

See 3 more Smart Citations

Sico

Birge-Lee

Wang

Rexford

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

Detecting and analyzing border gateway protocol blackholing activity

Farasat

Khan

2020

Int J Network Mgmt

View full text Add to dashboard Cite

Summary DDoS attack is a traditional malicious attempt to make an authorized system or service inaccessible. Currently, BGP blackholing is an operational countermeasure that builds upon the capabilities of BGP to protect from DDoS attacks. BGP enables blackholing by leveraging the BGP community attribute. This paper presents the analysis of BGP blackholing activity and propose a machine learning‐based mechanism to detect BGP blackholing activity. In BGP blackholing analysis, we find that many networks, including Internet service providers (ISPs) and Internet exchange points (IXPs), offer BGP blackholing service to their customers. We collect networks' blackhole communities and make BGP blackhole communities dictionary. Within 3‐month period (from August to October, 2018), we find a significant number of BGP blackhole announcements (97,532) and distinct blackhole prefixes (8,120). Most of the blackhole prefixes are IPv4 (99.1%). Among IPv4 blackhole prefixes, mostly are /32 (79.9%). The daily patterns of BGP blackholing highlight that there is a variable number of blackhole announcements and distinct blackhole prefixes every day. Furthermore, we apply machine learning techniques to design a BGP blackholing detection mechanism based on support vector machine (SVM), decision tree, and long short‐term memory (LSTM) classifiers. The results are compared based on accuracy and F‐score. Experimental results show that LSTM achieves the best classification accuracy of 95.9% and F‐score of 97.2%. This work provides insights for network operators and researchers interested in BGP blackholing service and DDoS mitigation in the Internet.

show abstract

A Taxonomy of Attacks Using BGP Blackholing

Miller

Pelsser

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

BGP Communities

Cited by 30 publications

References 18 publications

Sico

Sico

Detecting and analyzing border gateway protocol blackholing activity

A Taxonomy of Attacks Using BGP Blackholing

Contact Info

Product

Resources

About