Stop, DROP, and ROA

Replication: 20 Years of Inferring Interdomain Routing Policies

“…As a final remark, our goal is not to propose a new interdomain routing model, or infer more accurately the routing policies in the Internet, but to pinpoint the intersections and disparities of the results our replication effort against the findings and insights of the original work [63]. Finally, we believe that our results can aid in the understanding of a variety of interdomain routing applications, such as the measurement of the RPKI adoption [17,49], fine-grained interdomain policy learning [62,67], interdomain routing verification [10], privacy-preserving routing [13], discovering caching policies in the wild [18,34] and studying routing attacks [56].…”

The Resource Public Key Infrastructure (RPKI): A Survey on Measurements and Future Prospects

“…Oliver et al [122] investigated the usage patterns of 712 prefixes from Spamhaus' "Don't Route or Peer" (DROP) list [160], which operators frequently use to identify maliciously used address space. They found that for 32% of prefixes' IRR entries were created a month before the prefixes were added to the blocklist, highlighting the fact that the IRR is not a reliable source for filtering information since it can be easily manipulated.…”

BGP prefix hijack detection algorithm based on MOAS event feature

“…At the beginning of its design, the BGP protocol was oriented to a small range of trusted networks, and security issues were not in the scope of consideration. However, with the advancement of technology, the Internet has long become an open space, and due to the lack of effective security mechanisms, the BGP protocol is often subjected to malicious attacks, among which, prefix hijacking is the most discussed security issue among researchers [4][5][6][7][8][9][10][11][12] . In the process of route propagation, the BGP protocol does not examine the content of routes and route propagation paths, which leads to BGP prefix hijacking when an autonomous domain externally declares a prefix address block that does not belong to it or externally declares a prefix address that has not yet been assigned [13] .…”