Skip to content

Latest commit

 

History

History
75 lines (63 loc) · 3.73 KB

File metadata and controls

75 lines (63 loc) · 3.73 KB

References

The detection rules and data formats here come from operator practice and standards. This file is the bibliography you'd normally see at the end of a paper. Where possible, primary sources are linked; the BGP RFCs are the ground truth for protocol behavior.

Standards

  • RFC 4271A Border Gateway Protocol 4 (BGP-4). Y. Rekhter, T. Li, S. Hares (eds), 2006. https://www.rfc-editor.org/rfc/rfc4271. The protocol; defines what an UPDATE message is, what as-path and community attributes look like, what a withdraw is.
  • RFC 6480An Infrastructure to Support Secure Internet Routing. M. Lepinski, S. Kent, 2012. https://www.rfc-editor.org/rfc/rfc6480. RPKI: a stronger basis than RIB-derived baselines; not yet used here.
  • RFC 7908Problem Definition and Classification of BGP Route Leaks. K. Sriram et al., 2016. https://www.rfc-editor.org/rfc/rfc7908. Taxonomy used by the route-leak detector.
  • RFC 8893Resource Public Key Infrastructure (RPKI) Origin Validation for BGP Export. R. Bush et al., 2020. https://www.rfc-editor.org/rfc/rfc8893. ROA-based origin validation.

Data sources

Incident primary sources

Detection literature

The detectors here are deliberately simple. The papers below build the canonical taxonomy of the harder cases:

  • Ballani, Francis, Zhang, A Study of Prefix Hijacking and Interception in the Internet, SIGCOMM 2007. The framing of "exact-prefix" vs. "sub-prefix" hijacks the project leans on.
  • Lad, Massey, Pei, Wu, Zhang, Zhang, PHAS: A Prefix Hijack Alert System, USENIX Security 2006. Email-based alerting on origin-AS changes; one of the earliest real-world detection systems.
  • Sermpezis, Kotronis, Dainotti, Dimitropoulos, A Survey among Network Operators on BGP Prefix Hijacking, SIGCOMM CCR 2018. Operator perspective on which detection signals matter.
  • Sermpezis et al., ARTEMIS: Neutralizing BGP Hijacking Within a Minute, IEEE/ACM ToN 2018. The most-cited open-source comparison point; combines RPKI, RIR data, and live monitors. https://github.com/FORTH-ICS-INSPIRE/artemis.
  • Karlin, Forrest, Rexford, Pretty Good BGP, IEEE Network 2006. Latency vs. accuracy trade-off central to streaming detection.

Operational reports we draw framing from