Abstract
The Border Gateway Protocol (BGP) is a fundamental component of the current Internet infrastructure. Due to the inherent trust relationship between peers, control of a BGP router could enable an attacker to redirect traffic allowing man-in-the-middle attacks or to launch a large-scale denial of service. It is known that BGP has weaknesses that are fundamental to the protocol design. Many solutions to these weaknesses have been proposed, but most require resource intensive cryptographic operations and modifications to the existing protocol and router software. For this reason, none of them have been widely adopted. However, the threat necessitates an effective, immediate solution.
We propose a system that is capable of detecting malicious inter-domain routing update messages through passive monitoring of BGP traffic. This approach requires no protocol modifications and utilizes existing monitoring infrastructure. The technique relies on a model of the autonomous system connectivity to verify that route advertisements are consistent with the network topology. By identifying anomalous update messages, we prevent routers from accepting invalid routes. Utilizing data provided by the Route Views project, we demonstrate the ability of our system to distinguish between legitimate and potentially malicious traffic.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Asia Pacific Network Information Centre, http://www.apnic.net
American Registry for Internet Numbers, http://www.arin.net
Chandra, R., Traina, P., Li, T.: BGP Communities Attribute. IETF-RFC 1997 (August 1996)
Cheung, S.: An Efficient Message Authentication Scheme for Link State Routing. In: 13th Annual Computer Security Applications Conference (December 1997)
Convey, S., Cook, D., Franz, M.: An Attack Tree for the Border Gateway Protocol. In: IETF Internet Draft (October 2002)
Faloutsos, M., Faloutsos, P., Faloutsos, C.: On Power-Law Relationships of the Internet Topology. In: Proceedings of ACM SIGCOMM 1999 (1999)
Farrar, J.: Cable and Wireless Routing Instability, http://www.merit.edu/mail.archives/nanog/2001-04/msg00209.html
Gao, L.: On Inferring Autonomous System Relationships in the Internet. In: Proceedings of IEEE Global Internet (November 2000)
Goodell, G., Aiello, W., Griffin, T., Ioannidis, J., Mc-Daniel, P., Rubin, A.: Working Around BGP: An Incremental Approach to Improving Security and Accuracy of Interdomain Routing. In: Network and Distributed Systems Security (2003)
Govindan, R., Reddy, A.: An Analysis of Internet Inter-Domain Topology and Route Stability. In: IEEE InfoCom(1997)
Huffaker, B., Broido, A., claffy, k., Fomenkov, M., Keys, K., Lagache, E., Moore, D.: Skitter AS Internet Graph. In: CAIDA (October 2000)
Jou, Y.F., Gong, F., Sargor, C., Wu, X., Wu, F., Chang, H.C., Wang, F.: Design and Implementation of a Scalable Intrusion Detection System for the Protection of Network Infrastructure. In: DARPA Information Survivability Conference and Exposition (January 2000)
Kent, S., Lynn, C., Mikkelson, J., Seo, K.: Secure Border Gateway Protocol (Secure-BGP) - Real World Performance and Deployment Issues. In: Proceedings of the Symposium on Network and Distributed System Security (February 2000)
Kent, S., Lynn, C., Seo, K.: Secure Border Gateway Protocol (Secure-BGP). IEEE Journal on Selected Areas in Communications 18(4), 582–592 (2000)
Labovitz, C., Ahuja, A., Jahanian, F.: Experimental Study of Internet Stability and Wide-Area Network Failures. In: Fault-Tolerant Computing Symposium (June 1999)
Labovitz, C., Malan, G.R., Jahanian, F.: Origins of Internet Routing Instability. In: IEEE INFOCOM (March 1998)
The Latin American and Caribbean Internet Addresses Registry, http://www.lacnic.net
Mahajan, R., Wetherall, D., Anderson, T.: Understanding BGP Misconfiguration. In: Proceedings of ACM SIGCOMM (August 2002)
Malkin, G.: RIP Version 2. IETF-RFC 2453 (November 1998)
McCreary, S., Woodcook, B.: PCH RouteViews archive, http://www.pch.net/resources/data/routing-tables
Mittal, V., Vigna, G.: Sensor-Based Intrusion Detection for Intra-Domain Distance-Vector Routing. In: Proceedings of the ACM Conference on Computer and Communication Security (CCS 2002), Washington, DC, November 2002, ACM Press, New York (2002)
Moy, J.: OSPF Version 2. IETF-RFC 2328 (April 1998)
Murphy, S.: Border Gateway Protocol Security Analysis. In: IETF Internet Draft (November 2001)
Murphy, S.L., Badger, M.R.: Digital Signature Protection of the OSPF Routing Protocol. In: Proceedings of the Symposium on Network and Distributed System Security (February 1996)
The North American Network Operators’ Group, http://www.nanog.org
Qu, D., Vetter, B.M., Wang, F., Narayan, R., Wu, F., Jou, F., Gong, F., Sargor, C.: Statistical Anomaly Detection for Link-State Routing Protocols. In: Proceedings of the 1998 International Conference on Network Protocols (October 1998)
Przygienda, A., Hauser, R., Tsudik, G.: Reducing the cost of security in link state routing. In: ISOC Symposium on Network and Distributed System Security (February 1997)
Rekhter, Y., Li, T.: A Border Gateway Protocol 4 (BGP-4). IETF-RFC 1654 (March 1995)
Routing Arbiter Project, http://www.ra.net
Smith, B.R., Murthy, S., Garcia-Luna-Aceves, J.J.: Securing Distance-Vector Routing Protocols. In: Proceedings of the Symposium on Network and Distributed System Security (February 1997)
Subramanian, L., Agarwal, S., Rexford, J., Katz, R.H.: Characterizing the Internet Hierarchy From Multiple Vantage Points. In: IEEE INFOCOM (2002)
University of Oregon - Looking Glass, http://antc.uoregon.edu/route-views
Zegura, E., Calvert, K., Donahoo, M.: A quantitative comparison of graph-based models for internetworks. IEEE/ACM Transactions on Networking 5(6), 770–783 (1997)
Zhao, X., Pei, D., Wang, L., Massey, D., Mankin, A., Wu, S.F., Zhang, L.: An Analysis of BGP Multiple Origin AS (MOAS) Conflict. In: ACM SIGCOMM Internet Measurement Workshop, San Francisco, USA (November 2001)
Zhao, X., Pei, D., Wang, L., Zhang, L., Massey, D., Mankin, A., Wu, S.F.: Detection of Invalid Route Announcement in the Internet. In: International Conference on Dependable Systems and Networks (2002)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2003 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kruegel, C., Mutz, D., Robertson, W., Valeur, F. (2003). Topology-Based Detection of Anomalous BGP Messages. In: Vigna, G., Kruegel, C., Jonsson, E. (eds) Recent Advances in Intrusion Detection. RAID 2003. Lecture Notes in Computer Science, vol 2820. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-45248-5_2
Download citation
DOI: https://doi.org/10.1007/978-3-540-45248-5_2
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-40878-9
Online ISBN: 978-3-540-45248-5
eBook Packages: Springer Book Archive