Visual analytics for BGP monitoring and prefix hijacking identification

Abstract

Abstract-The control plane of the Internet relies entirely on BGP as inter-domain routing protocol to maintain and exchange routing information between large network providers and their customers. However, an intrinsic vulnerability of the protocol is its inability to validate the integrity and correctness of routing information exchanged between peer routers. As a result, it is relatively easy for people with malicious intent to steal legitimate IP blocks through an attack known as prefix hijacking, which essentially consists in injecting bogus routing information into the system to redirect or subvert network traffic. In this paper, we give a short survey of visualization methods that have been developed for BGP monitoring, in particular for the identification of prefix hijacks. Our goal is to illustrate how network visualization has the potential to assist an analyst in detecting abnormal routing patterns in massive amounts of BGP data. Finally, we present an analysis of a real validated case of prefix hijacking, which took place between April and August 2011. We use this hijack case study to illustrate the ongoing work carried out in VIS-SENSE, a European research project that leverages visual analytics to develop more effective tools for BGP monitoring and prefix hijack detection.

The State of the Art in BGP Visualization Tools: A Mapping of Visualization Techniques to Cyberattack Types

“…Additionally, they provide an overall domain characterization including challenges, data sources and users. [14,41,50,64,71,73,80], that not only considers the visualization techniques employed, but also lower-level visualization features, interaction methods, and use cases [5]. Additionally, they distinguish between BGP visualizations that are high-level, or overview, lower-level, or local view, and multi-view.…”

“…Finally, Youn et al presented a study on BGP visualization tools focused on cyber situational awareness [82]. Their survey canvassed 10 tools, seven of which appear in our study: [5,9,64,67,68,73,76], and give more specifics on the visualization techniques employed, core functions, level of detail and use cases. However, they do not consider the specific attacks used to validate the tools or attempt to map the visualization techniques to the attack types.…”

Research on Cyber IPB Visualization Method based on BGP Archive Data for Cyber Situation Awareness

“…This tool highlights aspects of BGP data that have received less attention in previous visualization applications to help form a complete picture of an important part of the Internet communications infrastructure. Ernst Biersack et al(2012) [9] proposed the VIS-SENSE model for analysts to detect abnormal routing patterns in vast amounts of BGP data through network visualization. We emphasized how to visualize BGP monitoring to identify prefix hijacking attacks through malicious intent.…”

Combining Exploratory Analysis and Automated Analysis for Anomaly Detection in Real-Time Data Streams

“…Management of worldwide Internet traffic is administered by tens of thousands of independent routing domain systems called autonomous systems (AS) (Biersack et al, 2012). An AS can be owned by network operators such as Internet Service Providers (ISPs).…”