Secure Border Gateway Protocol and the External Routing Intrusion Detection System

The Border Gateway Protocol (BGP), which is used to distribute routing information between autonomous systems (ASes), is a critical component of the Internet's routing infrastructure. It is highly vulnerable to a variety of malicious attacks, due to the lack of a secure means of verifying the authenticity and legitimacy of BGP control traffic. This paper describes a secure, scalable, deployable architecture, S-BGP, for a system that addresses most of the security problems associated with BGP. The paper discusses the vulnerabilities and security requirements associated with BGP, describes the S-BGP countermeasures, and explains how they address these vulnerabilities and requirements. The paper also provides a comparison of this architecture with other approaches that have been proposed, analyzes the performance implications of the proposed countermeasures, and reports on prototype implementation experience.

For long, software-defined network (SDN) has been the new trend in the field of networking. Despite being way better than the traditional networking approach, security issues related to SDN are a major concern for technologists all over the globe. It has drawn great attention and is still a highly interesting field of study for network administrators. Among the various means suggested to overcome these security issues, working with securing Border Gateway Protocol (BGP) seems to be a feasible solution to securing SDN. BGP deals with transferring data between two autonomous systems by exchanging routing information between the systems. In this paper, we propose an efficient way to secure data transfer, through BGP, between two autonomous systems in SDN. This is achieved by encrypting data using Advanced Encryption Standard (AES) Encryption Algorithm. In order to prove its feasibility, AES data encryption algorithm is implemented on two hosts in SDN and data transfer is traced on Wireshark. Furthermore, we extend our study to conclude that SDN can be secured by encrypting data over BGP and then transferring it safely to the destination.

Examining the Jurisdictions of Internet Routes to Prevent Data Exfiltration

Border Gateway Protocol (BGP) plays a critical role in the Internet inter-domain routing reliability. Invalid routes generated by mis-configurations or forged by malicious attacks may hijack the traffic and devastate the Internet routing system, but it is unlikely that a secure BGP can be deployed in the near future to completely prevent them. Although many hijacking detection systems have been developed, they more or less have weaknesses such as long detection delay, high false alarm rate and deployment difficulty, and no systematic detection results have been studied. This paper proposes Argus, an agile system that can accurately detect prefix hijackings and deduce the underlying cause of route anomalies in a very fast way. Argus is based on correlating the control and data plane information closely and pervasively, and has been continuously monitoring the Internet for more than one year. During this period, around 40K routing anomalies were detected, from which 220 stable prefix hijackings were identified. Our analysis on these events shows that, hijackings that have only been theoretically studied before do exist in the Internet. Although the frequency of new hijackings is nearly stable, more specific prefixes are hijacked more frequently. Around 20% of the hijackings last less than ten minutes, and some can pollute 90% of the Internet in less than two minutes. These characteristics make \emph{Argus} especially useful in practice. We further analyze some representative cases in detail to help increase the understanding of prefix hijackings in the Internet.

Border Gateway Protocol (BGP) is a widely used Internet routing protocol. While several security features have been introduced and implemented to prevent attacks and address routing instabilities, BGP remains vulnerable due to lack of integrity and authentication of BGP messages. BGP operations strongly depend on its security and attacks on BGP adversely influence packet routing. Given the importance of BGP security, several approaches have been developed to enhance security of BGP sessions. The Resource Public Key Infrastructure (RPKI), a specialized Public Key Infrastructure (PKI), was developed to help secure the Internet routing. It uses cryptographically verifiable statements to ensure that Autonomous Systems (ASes), the Internet resource holders, are certifiably linked to the routing information they generate thus resulting in a reliable routing origin. In this paper, we describe a testbed developed for validating route origin and present simulation results.

The border gateway protocol (BGP) is the default inter domain routing protocol used on the internet for exchanging information between autonomous systems. Available literature suggests that BGP is vulnerable to session hijacking attacks. There are a number of proposals aimed at improving BGP security which have not been fully implemented. This paper examines a number of approaches for securing BGP through a comparative study and identifies the reasons why these proposals have not been implemented commercially. This paper analyses the architecture of internet routing and the design of BGP while focusing on the problem of BGP session hijacking attacks. Using Graphical Network Simulator 3 (GNS-3), a session hijack is demonstrated and a solution which involves the implementation of route filtering, policy-maps and route-maps on CISCO routers representing ASes is carried out. In the end, a workable industry standard framework for securing and protecting BGP sessions and border routers from exploitation with little or no modification to the existing routing infrastructure is demonstrated.

Internet is known as the net of networks. It is a huge decentralized network composed by smaller inter-connected networks named autonomous systems (AS). The autonomous systems's interconnection is done by the Border Gateway Protocol (BGP). Several tools have been proposed to monitor BGP problems. Even though there is no long term indicator to rank Internet routes's health based on long term BGP problems long term periods. This paper quantifies the reach ability from several places in the world to many networks. We present a new model to measure network soundness, by quantifying the routing reach ability to a network. The metric is the percentage of the network that is present in the routing tables of selected routers around the world. A systematic monitoring system based on the analytic model is presented. Finally, we analyze the impact of the Chilean 2010 earthquake on the national network infrastructure, based on our model.

Inter-domain routing protocol routes network reachability information between autonomous systems (ASs) in the network. Network reachability information contains the details about the neighbors of the ASs and it contains messages used to maintain the connection between ASs. On one hand, given the size and the rapid growth of the Internet, any inter-domain routing protocol should satisfy basic desirable algorithmic properties, such as scalability, robustness and rapid convergence by Griffin, T., and Wilford, G. 1999. On the other hand, for economic reasons inter-domain routing should support policy routing, where Internet service providers (ISPs) have the flexibility to implement a wide variety of private routing policies that ISPs choose not to reveal. Moreover, the routing protocol should provide sufficient information to enable ISPs to make informed policy decisions. Border gateway protocol (BGP) by Goodell, G. et al. (2003) is the inter-domain routing protocol that is currently being used. BGP has a number of problems which includes scalability and large convergence time by Labovitz, C et al. (2000). This paper explains in detail the alternative to BGP which is the hybrid optimized link-state path-vector routing protocol (HLP) [1] and gives a comparison based on the simulation of these protocols. The comparison shows us that HLP overcomes some of the important problems faced in BGP.

In this paper, we investigate the issues related to the use of a BGP (Border Gateway Protocol) backbone to provide connectivity between mobile nodes, with a specific focus on nodes within an airborne network domain. Research efforts have developed multiple MANET (Mobile Ad hoc Network) protocols to provide routing for mobile nodes. In an airborne network environment, however, there may not be a dense enough concentration of nodes within radio range to provide the connectivity needed for effective use of a MANET protocol. In addition, aircraft within radio range of other nodes will experience intermittent and varying quality radio signals due to banking, interference, or Doppler effects. BGP is the de facto standard in use today to provide terrestrial internetworking routing among Autonomous Systems (AS) despite well known problems. BGP configuration can be complex and has convergence issues but the BGP capability to handle large numbers of routes makes it invaluable. In addition to its use in terrestrial internetworking, BGP has been identified as the routing protocol for the Transformational Satellite Communications System (TSAT) Network. Given the BGP networks in a satellite network above and a terrestrial network below an airborne network, it is important to understand the issues of connecting via BGP for airborne nodes. This paper summarizes the results of lab experiments evaluating use of a BGP network for an alternate routing path between aircraft when there is no other connectivity within their airborne routing domain.

Border gateway protocol (BGP) version 4 is routing current Internet for more than 20 years. BGP is the only protocol that has proven its routing capability of such size network with continually growing nature. Although BGP is scalable and network layer reachability information it lacks quality of service metrics like latency. BGP routing decision algorithm uses as-path length between autonomous systems (AS) as main factor for most of its best-path calculations. Because of more affordable peering architectures as-path length is generally decreasing in worldwide internet network resulting in less efficient routes for real-time internet protocol traffic. This study proposes future internet architecture consisting of multiple AS which provide latency aware routing in software defined network (SDN). For highest reliability there are bilateral latency measurements between each pair of connected autonomous systems. Latency measurement results are stored in distributed decentralized blockchain network where each AS holds its share. Each AS hosts an SDN instance for interconnection with neighbor SDN controllers over AS border. SDN instances processes latency measurement data from blockchain network, validates data integrity and manages latency aware routing for real-time data flows.

An anomaly is the occurrence of an exception that affects network security. The requirement for abnormality detection in a network is Anomaly detection, which detects and removes anomalous flow from the network. The Border Gateway Protocol (BGP) is the most common external Gateway Protocol used to communicate with autonomous systems to share routing and reachability information. This protocol's abnormal behavior may be caused by a variety of factors, including inadequate provisioning, malicious attacks, traffic or equipment issues, and network operator mistakes. BGP was built on the assumption of trust, and as a result, it has been hacked numerous times over the years. Code Red I is one well-known assault that targets BGP networking and produce abnormalities in its operation. These attacks were utilized as the dataset for training the model using network traffic data. The goal of this study is to detect the events that triggered an anomaly in the BGP during a time, as well as to detect an anomaly from the BGP throughout that time interval using the training dataset model. We present real association rule mining for BGP anomaly detection in the Intrusion Detection System (IDS).

BGP (Border Gateway Protocol) is one of the core internet backbone protocols, which were designed to address the large-scale routing among the ASes (Autonomous System) in order to ensure the reachability among them. However, an attacker can inject update messages into the BGP communication from the peering BGP routers and those routing information will be propagated across the global BGP routers. This could cause disruptions in the normal routing behavior. Specially crafted BGP messages can reroute the traffic path from a source ASN to a specific destination ASN via another path and this attack is termed as AS Path Hijacking. This research work is focused on the detection of suspicious deviation in the AS path between a source and destination ASNs, by analyzing the BGP update messages that are collected by passive peering to the BGP routers. The research mainly focuses on identifying the AS Path Hijacking by quantifying: (1). How far the deviation occurred for a given AS Path and (2). How much credible is the deviated AS path. We propose a novel approach to calculate the deviation occurred by employing weighted edit distance algorithm. A probability score using n-gram frequency is used to determine credibility of the path. Both the scores are correlated together to determine whether a given AS Path is suspicious or not. The experimental results show that our approach is capable of identifying AS path hijacks with low false positives.

Border Gateway Protocol (BGP) is the defacto inter-domain routing protocol in the Internet. It was designed without an inherent security mechanism and hence is prone to a number of vulnerabilities which can cause large scale disruption in the Internet. Route leak is one such inter-domain routing security problem which has the potential to cause wide-scale Internet service failure. Route leaks occur when Autonomous systems violate export policies while exporting routes. As BGP security has been an active research area for over a decade now, several security strategies were proposed, some of which either advocated complete replacement of the BGP or addition of new features in BGP, but they failed to achieve global acceptance. Even the most recent effort in this regard, lead by the Secure Inter-Domain Routing (SIDR) working group (WG) of IETF fails to counter all the BGP anomalies, especially route leaks. In this paper we look at the efforts in countering the policy related BGP problems and provide an analytical insights into why they are ineffective. We contend a new direction for future research in managing the broader security issues in the inter-domain routing. In that light, we propose a naive approach for countering the route leak problem by analyzing the information available at hand, such as the RIB of the router. The main purpose of this paper was to position and highlight the autonomous smart analytical approach for tackling policy related BGP security issues.

Border Gateway Protocol (BGP) serves as the primary routing protocol responsible for exchanging routing information between Internet Autonomous Systems (AS). Accurate BGP performance prediction is crucial for maintaining network stability and optimizing routing decisions. With the rapid evolution of the Internet, modern network architectures have become increasingly complex, exhibiting heterogeneous and highly dynamic characteristics. Networks encompass diverse devices, protocols, and inter-AS connections, making it challenging for traditional BGP performance prediction models to adapt to complex network environments. Traditional models often rely on predefined assumptions, such as static AS relationships, which prove inadequate when confronting constantly changing network topologies, fluctuating traffic patterns, and variable BGP routing decisions in realworld networks. Moreover, the heavy dependence of traditional models on specific data structures and network relationships further limits their generalization capabilities in broader applications.To address these challenges, this paper proposes a novel Deep Neural Network (DNN)-based model for predicting BGP convergence time using historical routing data from sources such as RouteViews and RIPE NCC. Our model employs comprehensive feature engineering, Principal Component Analysis (PCA) for dimensionality reduction, and Dropout regularization to effectively capture complex nonlinear relationships in BGP data. Experimental results demonstrate that the DNN model outperforms traditional methods, achieving an Area Under the Curve (AUC) value of 0.83, with accuracy trends and Receiver Operating Characteristic (ROC) curves validating its superior performance. Future research will incorporate temporal dynamics through Recurrent Neural Networks (RNN) to enhance real-time performance prediction capabilities in dynamic network environments.

We present an evaluation methodology for comparison of existing and proposed new algorithms for Border Gateway Protocol (BGP) anomaly detection and robustness. A variety of algorithms and alert tools have been proposed and/or prototyped recently. They differ in the anomaly situations which they attempt to alert or mitigate, and also in the type(s) of data they use. Some are based on registry data from Regional Internet Registries (RIRs) and Internet Routing Registries (IRRs) - an example is the Nemecis tool. Others such as the Prefix Hijack Alert System (PHAS) and the Pretty Good BGP (PGBGP) are driven by BGP trace data. The trace data is obtained from Reseaux Internet Protocol Europeens - Routing Information Service (RIPE-RIS), Routeviews, or a BGP speaker where the algorithm operates. We propose a new algorithm that combines the use of both registry and trace data, and also makes some key improvements over existing algorithms. We have built an evaluation platform called TERRAIN (Testing and Evaluation of Routing Robustness in Assurable Inter-domain Networking) on which these algorithms can be tested and empirically compared based on real and/or synthetic anomalies in BGP messages. We will present a variety of results providing interesting insights into the comparative utility and performance of the various BGP robustness algorithms.