A System to Detect Forged-Origin BGP Hijacks
Talkat 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) · 2024-04-16..04-18·
summary
A deployed system called DFOH detects forged-origin BGP hijacks across the global RIB by classifying new AS links with a random-forest model trained on 11 topological features, PingDB and iPath-pattern signals and a balanced sampling scheme that corrects tier bias. It runs on commodity servers, catches about 90.9% of forged-origin hijacks within ≈5 minutes, keeps maximum false positive rate near 15%, and surfaces roughly 17.5 suspicious cases per day for operator investigation.
AI-written summary · about
chapters (7)
- 0:00BGP hijacks overview
- 3:45Forged-origin detection challenge
- 5:55Inference pipeline features
- 10:13Training link prediction model
- 12:42Evaluating inference accuracy
- 14:29DEFO system deployment
- 15:14Summary
related talks
35mRoute to Bugs: Analyzing the Security of BGP Message Parsing
21mStealth BGP Hijacks with uRPF Filtering
16mAres: Comprehensive Path Hijacking Detection via Routing Tree
28mA World-View of IP Spoofing in L4 Volumetric DoS Attacks - and a Call to Enable BCP38
59mCatching Malware En Masse: DNS and IP Style
11mGotta Detect 'Em All: Fake Base Station and Multi-Step Attack Detection...
43mHow to make an accurate Geo-IP database
52mInvestigating DDOS - Architecture Actors and Attribution