Collaborative Network Security: Targeting Wide-area Routing and Edge-network Attacks

Abstract

To ensure that services can be delivered reliably and continuously over the Internet, it is important that both Internet routes and edge networks are secured. However, the sophistication and distributed nature of many attacks that target wide-area routing and edge networks make it difficult for an individual network, user, or router to detect these attacks. Therefore collaboration is important. Although the benefits of collaboration between different network entities have been demonstrated, many open questions still remain, including how to best design distributed scalable mechanisms to mitigate attacks on the network infrastructure. This thesis makes several contributions that aim to secure the network infrastructure against attacks targeting wide-area routing and edge networks.First, we present a characterization of a controversial large-scale routing anomaly, in which a large Telecom operator hijacked a very large number of Internet routes belonging to other networks. We use publicly available data from the time of the incident to understand what can be learned about large-scale routing anomalies and what type of data should be collected in the future to diagnose and detect such anomalies.Second, we present multiple distributed mechanisms that enable collaboration and information sharing between different network entities that are affected by such attacks. The proposed mechanisms are applied in the contexts of collaborating Autonomous Systems (ASes), users, and servers, and are shown to help raise alerts for various attacks. Using a combination of data-driven analysis and simulations, based on publicly available real network data (including traceroutes, BGP announcements, and network relationship data), we show that our solutions are scalable, incur low communication and processing overhead, and provide attractive tradeoffs between attack detection and false alert rates.Finally, for a set of previously proposed routing security mechanisms, we consider the impact of regional deployment restrictions, the scale of the collaboration, and the size of the participants deploying the solutions. Although regional deployment can be seen as a restriction and the participation of large networks is often desirable, we find interesting cases where regional deployment can yield better results compared to random global deployment, and where smaller networks can play an important role in achieving better security gains. This study offers new insights towards incremental deployment of different classes of routing security mechanisms.This work was supported by the Swedish National Graduate School of Computer Science (CUGS) and the Internet Foundation in Sweden (IIS). iii Populärvetenskaplig sammanfattningInternet och dess tjänsterär mycket exponerade för attacker. Många av de kritiska protokoll och mekanismer som behövs för att leverera tjänsteröver internet designades för flera decennier sedan. Dessa protokoll och mekanismerär starkt beroende av tillit mellan olika nätverkskomponenter, såsom routers och servrar. Den ex...