Accurate Real-time Identification of IP Hijacking

In this paper, we present novel and practical techniques to a ccur tely detect IP prefix hijacking attacks in real time to facilitate timely mitigation respon ses. There are strong evidences that IP hijacking is common on today’s Internet. Attackers may hi jack victim’s IP address space to perpetrate malicious activities such as spamming and launc hing DoS attacks without worrying about disclosing their identity through source IP addresses. Mor e se iously, they can disrupt network services or regular communication by temporarily stealing actively used addresses. Unintentional network misconfigurations can also have similar effects, possibly l eading to severe impact on reachability. We propose novel ways to much more accurately detect IP hijacki ng by combining analysis of passively collected BGP routing updates and data plane fingerprints of suspicious prefixes. The key insight is to use data plane information in the form of edge network finge rprinting to disambiguate potentially numerous suspect IP hijacking incidences based on routing a nom ly detection. Previous work on identifying IP hijacking solely relies on c ontrol plane information in the form of anomalous routing updates or external data such as stale a ddr ss registries. Such an approach is inaccurate, suffering from too many false positives to be us ful in practice. In our proposed scheme, real-time fingerprinting provides confirming evidence for h ijacking, while incurring little overhead. More importantly, we provide mechanisms to perform online m itigation rather than post-mortem analysis. Utilizing real-time BGP data from multiple feeds as well as RouteViews, we demonstrate the ability of our system to distinguish between legitimate routing changes and hijacking attacks.