The Maestro Attack: Orchestrating Malicious Flows with BGP

TL;DR

The paper introduces the Maestro attack, a new BGP-based link flooding method that can significantly amplify DDoS attacks by manipulating routing, with small ASes capable of executing devastating attacks and offering mitigation strategies.

Contribution

It presents the Maestro attack, demonstrating how control-plane traffic engineering can be exploited to concentrate malicious flows and significantly increase attack impact.

Findings

Maestro attack can increase DDoS flow density by over 30%.

Small ASes can execute devastating attacks on core links.

Effective mitigations for network operators are proposed.

Abstract

We present the Maestro attack, a novel Link Flooding Attack (LFA) that leverages control-plane traffic engineering techniques to concentrate botnet-sourced Distributed Denial of Service flows on transit links. Executed from a compromised or malicious Autonomous System (AS), Maestro advertises specific-prefix routes poisoned for selected ASes to collapse inbound traffic paths onto a single target link. A greedy heuristic fed by publicly available AS relationship data iteratively builds the set of ASes to poison. Given a compromised BGP speaker with advantageous positioning relative to the target link in the Internet topology, an adversary can expect to enhance total flow density by more than 30%. For a large botnet (e.g., Mirai), that translates to augmenting a DDoS by more than a million additional infected hosts. Interestingly, the size of the adversary-controlled AS plays little role in this amplification effect. Devastating attacks on core links can be executed by small, resource-limited ASes. To understand the scope of the attack, we evaluate widespread Internet link vulnerability across several metrics, including BGP betweenness and botnet flow density. We then assess where an adversary must be positioned to execute the attack most successfully. Finally, we present effective mitigations for network operators seeking to insulate themselves from this attack.

Tables

Table 1. Table 1. Maestro result summary, provider to customer betweenness link selection, customer-only attack

	Pre-Attack Vulnerability			Post-Attack Vulnerability			Avg. # Adversaries			Std. Dev of # Adv.
Vulnerability Threshold	25%	50%	75%	25%	50%	75%	25%	50%	75%	25%	50%	75%
Mirai	0.44	0.18	0.09	0.97	0.91	0.87	135.45	114.64	91.22	349.69	312.94	215.85
Conficker	0.44	0.21	0.08	0.96	0.91	0.85	151.25	100.01	92.35	360.26	226.39	216.06
Blackenergy	0.38	0.23	0.10	1.00	0.94	0.87	130.61	103.98	92.48	335.06	273.92	217.14

Full text

Routing Security; DDoS; BGP Poisoning; Adversarial Autonomous Systems (ASes)

††copyright: none††journalyear: 2019

1. Introduction

Distributed denial of service (DDoS) attacks direct traffic from many distinct sources on the Internet to overwhelm the capacity of links or end hosts. These attacks proliferate despite extensive academic and economic investment in mitigation, and intensify with the Internet’s expansion to new devices and services. A reflection attack fueled by unprotected memcached servers, for example, temporarily disabled Github (Majkowski, 2018). Link Flooding Attacks or LFAs are DDoS attacks on infrastructure links (Kang et al., 2013; Studer and Perrig, 2009). LFAs may have moved from proposed attack to present threat: in 2016, a Mirai botnet-sourced attack directed over 500 Gbps of traffic to a Liberian infrastructure provider in what may have been a real-world LFA (Scott Sr and Summit, 2016).

A botnet can only launch an LFA if there exists some set of destinations such that bot traffic addressed to those hosts traverses the target link. As a result, the reach of an LFA attacker is constrained by Internet routing choices. It turns out that these route selection constraints protect the majority of Internet links from large volumes of botnet traffic. Even highly trafficked links in the Internet’s dense core, the most plausible targets for an LFA (Studer and Perrig, 2009; Kang et al., 2013), are not universally exposed to bot traffic.

This LFA limitation results from bots’ inability to choose the links their traffic transits to a given destination. That choice rests with the Autonomous Systems, or ASes, the bots reside within. In this work, we examine how an adversary’s ability to influence routing decisions - i.e., access to a compromised Boarder Gateway Protocol, or BGP speaker - can shape remote networks’ path selection process to their advantage. Our novel attack, Maestro, orchestrates path selection of remote ASes and bot traffic destinations to steer malicious flows onto links otherwise unreachable by the botnet. Our attack requires an adversary to have two tools: an edge router in some compromised AS and a botnet.

The Maestro attack utilizes a BGP traffic engineering technique called BGP poisoning to adjust the path from remote networks to the compromised BGP speaker’s network. By adjusting these inbound paths to flow over the targeted link, the adversary gains a destination for bot traffic that traverses the target. The attacker then launches a traditional DDoS attack against the compromised BGP speaker’s network, resulting in attack flows that congest the otherwise unreachable link. Maestro relies on a greedy algorithm to efficiently compute which ASes to poison given a botnet distribution, targeted link, and compromised BGP speaker location in order to force botnet traffic over the victim link. Our algorithm on average maneuvers 80% of the bots in a botnet over links vulnerable to the Maestro attack with just five poisons.

We evaluate both the attacker’s need for the Maestro attack, as well as its effectiveness. Our simulations join botnet models derived from real-world bot distributions with CAIDA’s Internet topology data to quantify the vulnerability of Internet links to LFAs. The goal is to measure how Internet routing characteristics limit Link Flooding Attacks. These initial experiments will motivate our attack by illustrating the prevalence of likely LFA targets that are unreachable by real world botnets. For one of our link sample sets, we found that between 18% to 23% of links are traversable by the majority of hosts in three major botnets. Fewer than 10% of sampled links were vulnerable to 75% or more bots.

In the same simulation framework, we demonstrate the Maestro attack’s ability to both amplify Link Flooding Attacks for already-vulnerable links, and to extend a botmaster’s reach to previously unexposed targets. After executing the Maestro attack from a well-positioned adversary, more than 90% of the previous set of links are exposed to a majority of bots across each botnets, and 85% to 87% of links are exposed to 75% of bots. Our analysis explores a number of different target link/compromised BGP speaker selection methods in an effort to explore how these properties factor into attack success. Additionally, we explore how a compromised AS can "leak" valley paths to expose Tier 1 peering links to Link Flooding Attacks.

We also consider defenses to mitigate the Maestro attack. The relative effectiveness of potential defenses are explored via simulation, with in-depth discussion of results. Our goal is to give a first look into mitigation techniques network operators can individually deploy to protect their links from the Maestro attack without global coordination. Feedback from outreach to the network operator community is also be presented.

We make the following key contributions throughout the rest of the paper:

• •

We measure how Internet routing properties limit Link Flooding Attacks in Section 3.

• •

We develop a technique to overcome these limitations: the Maestro attack. We explore the setup and execution of this attack in Section 4.

• •

We evaluate our attack, Maestro, via realistic simulations on an up-to-date Internet model in Section 5. There we will also present and evaluate a valley path leak attack.

• •

We develop an understanding of the Internet’s large-scale vulnerability to Maestro in Section 6.

• •

We propose and evaluate mitigations to our attack, as well as seek operator feedback from mailing lists in Section 7.

2. Background

2.1. Border Gateway Protocol

The Border Gateway Protocol (BGP) (Rekhter and Li, 1995) is the de facto routing protocol of the Internet. BGP enables over 60,000 Autonomous Systems (ASes) (Hawkinson and Bates, 1996) to exchange routing information and connect disparate parts of the Internet’s infrastructure. Routes in BGP are defined by a destination IP prefix and a collection of attributes, including the AS PATH or AS-level hops to reach the destination. ASes originate routes to hosted IP prefixes via BGP advertisements to neighboring ASes. An AS’s routers store received paths and make decisions about which paths to use for each destination prefix. Each AS chooses paths per prefix based on attributes of stored paths, most notably AS PATH length and LOCAL PREF. LOCAL PREF represents the AS operator’s local policy choices regarding path qualities. LOCAL PREF holds precedence over AS PATH length in the decision process. Of all available paths, the longest prefix matching rule dictates that the stored path with the longest (most specific) IP prefix match is used to forward packets when received.

Because the BGP decision process draws on path and policy attributes in route selection, BGP is a path-vector algorithm with policies. These policies often manifest themselves as a result of the unique business relationships on the Internet. ASes can have peers, customers, and providers. Peers exchange traffic for free, customers pay to exchange traffic through a provider, and providers gain economic incentives for traffic exchange provided to customers. Due to this economic aspect, the Internet topology is shaped by behaviors dictated by the valley-free routing model (Gao, 2001) and shown in Figure 14 in the appendix. In simple terms, the model states that BGP routes will not transit from a customer to a provider after transiting from a provider to a customer, which ensures ASes do not incur monetary costs whenever possible.

2.2. BGP Poisoning

The BGP decision process gives local operators control over outbound paths. Unfortunately, operators have relatively little influence on inbound traffic paths. Techniques do exist for next-hop inbound path control, including the MULTI EXIT DISC (exit discriminator) attribute (McPherson and Gill, 2006) and BGP communities (Donnet and Bonaventure, 2008), but both are subject to the source AS’s policies. This means inbound path control cannot be exerted by a destination AS arbitrarily on the broader Internet. Fortunately, BGP poisoning, a traffic engineering technique growing in use in academic and operator communities (Smith and Schuchard, 2018; Smith et al., 2019; Tran et al., 2019; Katz-Bassett et al., 2012; Anwar et al., 2015; Schuchard et al., 2012), allows for the manipulation of an AS’s inbound traffic routes without coordination from other ASes.

BGP poisoning relies on two characteristics of BGP: loop detection and longest-prefix matching. Longest-prefix matching was discussed earlier, but loop detection is a specified BGP behavior where an AS will drop paths which already contain its own AS number (ASN). This prevents loops, but it also allows BGP poisoning. An illustration of BGP poisoning is shown in Fig. 1. The advertising or poisoning AS advertises a more specific (longer) prefix for the traffic it wishes to move. Longest prefix matching means that ASes directing traffic to included IPs will switch on to the new route (see AS 2). However, some set of ASes are included in the AS PATH for the advertisement, sandwitched between copies of the originator’s ASN. Because they are notionally "on" the AS PATH, these ASes are poisoned; that is, they will detect a loop and drop the advertisement. While these poisoned ASes still have connectivity to the advertising AS’s other prefixes, their traffic flows are unchanged by the advertisement. The poisoning AS has adjusted inbound traffic paths without reliance on remote AS policies. Notably, poisoning functions on a per-prefix basis.

2.3. Distributed Denial of Service

Distributed Denial of Service (DDoS) describes a coordinated attack on a target link or end host using traffic from multiple sources. Often the traffic sources for these attacks are botnets, or networks of compromised end hosts (bots) under an attacker’s control. Botnets can include PCs, IoT devices, and/or SCADA systems, and are freely available for rent as attack sources from illicit online marketplaces. The most common form of DDoS is volumetric DDoS, where an attacker uses the sheer magnitude of malicious traffic flows to overwhelm a target. These attacks have been carried out by nation-states (Case, 2016; Herzog, 2011), and can also be used to isolate or degrade Internet performance for large geographic regions (Oracle Dyn, 2016) by targeting core DNS or network infrastructure providers.

A more recent class of DDoS attacks, Link Flooding Attacks (LFAs), targets network infrastructure rather than end hosts. One of the first such attacks in the literature is Coremelt (Studer and Perrig, 2009). Coremelt specifies that a botmaster 1) map which links are present on paths on routes between bots, 2) target a specific link used on paths between many bots, and 3) direct bot traffic between bots over the link. The resulting $n^{2}$ flows (for $n$ bots with paths over the link) overwhelms benign traffic on the target link. The bot traffic is especially difficult to classify/filter as it is “wanted" by the destination host and therefore appears legitimate. The Crossfire attack, like Coremelt, targets Internet links, but has the more ambitious goal of isolating an entire region (military installation, university, geographic region, etc.) by targeting key links (Kang et al., 2013). Rather than directing traffic to one another, bots map paths to publicly available web services (decoys) that transit target links. In the Crossfire evaluation, the decoys were PlanetLab servers. Bots then use sustained, low-intensity flows to the decoys to execute the attack, a pattern that makes Crossfire extremely difficult to detect and counter.

2.4. Adversarial BGP

Beyond DDoS, adversaries continue to exploit long-known vulnerabilities in the Internet’s routing architecture in increasingly sophisticated control-plane attacks. In 2014, researchers discovered a Canadian ISP surreptitiously hijacking bitcoin mining related traffic to steal victim miners’ computational work, netting over 80,000 (Litke and Stewart, [2014](#bib.bib31)). Academic research has explored this space with recent papers on hijacking bitcoin traffic and the Tor privacy system with BGP (Apostolaki et al., [2017](#bib.bib5); Sun, Yixin et al., [2015](#bib.bib47)). On a larger scale, fraudulent networks designed to deceive advertisers into paying for automated ad views have raked in multi-million dollar hauls (White Ops, [2016](#bib.bib51)). One such operation, 3ve, persisted for several years, even registering their own ASes, and earned nearly 30 million (Google Security and White Ops, 2016). These examples serve to demonstrate that attackers are capable and willing of leveraging the control-plane to accomplish their goals.

2.5. Key Terminology

Before we proceed, we now summarize key terminology in the paper, which we will cover in more detail in the next section:

Poisoned/poisoning advertisement/route/path: A route originated with selected ASes included between copies of the originator’s ASN. This technique will be exploited to prevent route installation/propagation by the selected ASes.

Adversary/Compromised AS: A compromised AS used to issue poison advertisements for a prefix. Botnet flows are then directed to the advertised prefix. The path of these flows is manipulated via BGP poisoning to steer them onto a target link.

Poisoned AS: An AS included in a poisoned advertisement. Loop detection prevents these ASes from installing the route.

Link Flooding Attack (LFA): DDoS targeting a link in the Internet topology rather than an end host.

Target link: The link targeted by the adversary AS executing Maestro.

From AS/To AS: The endpoint ASes of the target link. The From AS is the target link source; the To AS is the target link destination.

Flow density: Our primary attack success metric. Bot-to-bot flow density is the percentage of infected hosts in a botnet with paths to another infected host that transit the target link; (bot-to-any flow density is the percentage of infected hosts with a path to any destination that transits the target link.

Link betweenness: The number of times a link appears on best paths between ASes.

Link relationship: The economic relationship between link endpoints. A provider to customer is a link from a provider to one of its customers; a customer to provider link is the same link in the reverse direction. A peer/peering link connects peer ASes.

Customer cone: The set of all ASes reachable from an AS via only customer links. That is, direct/indirect customers of an AS.

Adversarial region: A measure of the adversary AS’s positioning relative to the target link. The customer region includes the customer cone of the To AS. The peer region is all ASes reached from a To AS peer, while the provider region includes any AS reached from a provider of the To AS.

Attack path: A valley-free path from some malicious flow source (e.g., an AS containing infected hosts) to the adversary AS that transits the target link.

3. Measuring Botnet Reach

To execute a successful Link Flooding Attack (see Section 2.3 earlier) on an Internet link, a botnet must be able to drive traffic over it. To accomplish this, the botmaster must find paths between a sufficient number of bots and other destinations that cross the target link. This allows the traffic to be aggregated at the target, which is degraded by overwhelming flows and fails to transit benign traffic. This failure realizes the initial goal of the DDoS.

However, prior work on link-flooding DDoS attacks often 1) do not perform their measurements with distribution data from a real botnet, notably Kang et al.’s Crossfire (Kang et al., 2013) (recall their approach uses PlanetLab servers which are traffic and location-limited as research platforms), 2) assume botnets can direct significant flows over arbitrary links on the Internet, including Tran et al.’s examination of the feasibility of LFA defense mechanisms using re-routing (Tran et al., 2019), or 3) choose specific links based on botnet flows, including Coremelt (Studer and Perrig, 2009; Schuchard et al., 2010). With these limitations in mind, we set out to examine the limitations of LFAs based on the topological positioning of available botnets. We seek to illustrate the critical nature of select core Internet links by examining their relative usage.

For this purpose, we classify and examine links by betweenness, defined as the number of times a link appears on the currently-used (best) path between any pair of ASes. High betweenness indicates that a link carries traffic between many ASes; a low betweenness link serves relatively few ASes. Fig. 2a shows the cumulative distribution of Internet links on the y-axis by betweenness, based on CAIDA’s AS relationship inference (at UCSD, 2019). This figure shows that clearly not all links have the same importance. The majority of links appear on 10 or fewer paths, but select links have a betweenness of more than 1 million. These high betweenness links connect more than 1,000 AS source/destination pairs. While we do not expect the low betweenness links to have high amounts of bot-to-bot paths over them, we do expect high amounts of viable paths for the high betweenness links. Accordingly, attacks on these critical links would wreak havoc with upstream and downstream networks, threatening entire regions.

Next, we set out to measure the reach of botnets using real botnet models, built from IP mappings collected for three of the largest botnet families: Conficker, Mirai, and BlackEnergy. These models allow us to measure the relative exposure of Internet links to attacks based on real-world botnet distribution data. We then quantify link vulnerability via flow density: the percentage of a botnet’s infected hosts with paths over the target link to either 1) another bot, called bot-to-bot flow density, or 2) any destination, called bot-to-any flow density. These two metrics were both covered in the prior section on LFAs. The bot-to-bot flow density models the effectiveness of the Coremelt attack, and the bot-to-any flow density models the Crossfire attack. Fig. 2b depicts the results of our second experiment, measuring bot-to-bot flow density as a function of betweenness for Internet links. Note that some low betweenness (peripheral) links are, not unexpectedly, wholly outside an LFA attacker’s reach. Critically, some moderate to high betweenness (core) links are also partially or completely devoid of paths between bots. We note that relaxing our attack technique by allowing bots to send traffic to any AS destination does not significantly alleviate these limitations, as shown in Fig. 2c. This means that both Coremelt and Crossfire as measured previously make false assumptions based on the real distributions of botnets available to those systems.

Given that these highly trafficked links within the Internet’s core could be both high-value targets to an adversary and outside the reach of existing LFAs, it is intuitive to investigate whether a routing-capable adversary can manipulate the control-plane to expose them. Next, we will introduce the Maestro attack, a novel combination of traffic engineering techniques with LFAs that 1) increases the flow density a botmaster can drive onto target links, and 2) enables an adversary to steer flows onto previously unreachable targets. This combination is the first known attack to combine inbound traffic influence mechanisms such as BGP poisoning and powerful botnet-based DDoS attacks from both research and practice.

4. The Maestro Attack

We have demonstrated that most links, including many likely LFA targets, are not vulnerable to the full force of a botnet. This condition arises from the lack of end host control over traffic routes; bots cannot always find a destination for their traffic that crosses a target link. The Maestro attack, introduced in this section, is designed to alter the control-plane to expose these links. In this section, we present the threat model for a Maestro attacker, followed by a high-level description of the attack and implementation details.

4.1. Threat Model

To execute the attack, an adversary requires 1) command of a botnet and 2) control of a BGP speaker, i.e., an AS’s edge router. The first item is trivially obtainable, as botmasters routinely monetize their networks by renting them out in an attack-as-a-service model on the dark web (Putman et al., 2018). Recent events demonstrate that multiple feasible avenues exist for adversaries to gain routing capability. The 3ve fraud operation (Google Security and White Ops, 2016) demonstrated the most straightforward route - simply registering a new AS. Network operators could also be compromised by an insider, as may have occurred in the Canadian bitcoin hijack (Litke and Stewart, 2014). Recent Cisco router zero-days demonstrate the ongoing possibility of remote attackers, as well (Red Balloon Security, Inc., [n. d.]). Finally, BGP has previously been weaponized for intelligence gathering (Demchak and Shavitt, 2018) and censorship (Dainotti et al., 2011) by nation states. While powerful nation-state adversaries have many other tools, they certainly have the leverage to execute Maestro.

Of course, the degree to which a compromised AS can exert control for the attack may vary with its topological position relative to the target. We will address this question in Section 5. Note that a Maestro attacker does not need to control every end host in the network - they only need to issue advertisements from an edge router.

4.2. Maestro Concept

Bots are located in disparate ASes; to dictate outbound bot traffic paths would require that an adversary control every network. Such an adversary is far more powerful the one in our threat model. Maestro’s central insight is that a routing-capable adversary can issue poisoned advertisements to alter inbound paths to themselves. If an adversary first directs bot traffic to an AS/prefix they control (the compromised AS or adversary AS), the adversary can orchestrate those flows onto a target link using poisoned BGP advertisements (like a conductor, or maestro). We call the origin endpoint of the target link the From AS and destination endpoint of the target link the To AS. Note that the adversary cannot directly influence route selection in the ASes hosting bots; rather, BGP poisoning essentially bypasses route selection by presenting a more specific prefix to those ASes.

In effect, this also executes a traditional DDoS against the adversary AS. This is of little concern to an adversary who compromises an AS they do not own, like those in Section 2.4. Fig. 3 shows the attack in abstract, with link $5\mapsto 6$ as the target. Before the attack, traffic from bot-infected ASes (ASes 0-3) to the adversary (AS 10) flows around (and not over) the target link. AS 10 first issues specific prefix advertisements with ASes 4 and 6 poisoned. This causes inbound flows from the bot-infected ASes to the adversary to concentrate over the target link. After altering these paths, the adversary AS (AS 10) directs bot traffic to itself. The result is a channeled DDoS flowing over $5\mapsto 6$.

4.3. Poison Selection Algorithm

The attacker’s core utility is an algorithm we developed to determine which ASes to poison to maximize inbound bot traffic over the target link. We call this set of ASes the poison set. These ASes will be sandwiched between the compromised ASN in the poisoned advertisement (see Section 2.2 on BGP poisoning). Finding a poison set that successfully steers bot traffic is a non-trivial task, because poison sets can conflict; that is, the poisons required to steer one bot-containing AS (or source AS) onto the target link will disconnect from the advertised prefix both the poisoned ASes and all ASes requiring an AS from the poison set to reach the adversary AS. Additionally, each poison increments the poisoning advertisement’s AS PATH by 1. Because excessively long paths are often filtered, the number of ASes we can poison in practice is limited.

We developed a MAX SAT formulation of the optimal poison choice problem, but its high runtime complexity and failure to exploit the specific structure of our problem led to the heuristic explained below. For completeness, the optimal choice formulation is included in the appendix, Section A.

4.3.1. Iterative Poison Choice Heuristic

We begin from the observation that the adversary wants to selectively poison ASes on source AS paths to the adversary that do not cross the target link in an attempt to force source ASes to switch onto paths that do contain the target link. Intuitively, the adversary wants to form a bottleneck to the poisoning prefix over the target link.

Our poison choice heuristic represents the core of the Maestro attack. Once it is used to determine the poison set, the adversary only has to issue the poisoned advertisement and direct bot traffic to the poisoned prefix. We will build this poison set iteratively. At each iteration, we begin by partitioning ASes into four sets:

1. Sacred ASes. This set is initialized with the From AS, the To AS, and the adversary AS. It will be updated at each iteration with every AS that appears on all paths from the To AS to the adversary AS. Naturally, we must have a path for traffic from the target link to the poisoning prefix, so these ASes should never be poisoned.

2. Disconnected ASes, which includes those poisoned and those without a route to the advertising prefix that does not transit a poisoned AS.

3. Successful ASes are those already transiting the target link to the adversary.

4. Source ASes who are not yet sacred, disconnected, or successful.

After these sets are updated, we select an AS to poison from the source ASes and add it to the poison set. Finally, we simulate the remaining source AS’s path changes in response to the new poison set, and move to the next iteration.

We will terminate iteration when no ASes remain in the source set. An additional termination condition is reached if the poison set (which is included in the AS PATH as described in Section 2.2) causes the AS PATH to exceed the size AS operators will almost certainly filter in practice: around 254 hops (Tran et al., 2019; Ivan Pepelnjak, 2009). We will show in Section 7 that this condition is rarely required.

At every iteration, the adversary must select one of the source ASes to poison. To accomplish this, we select the AS with the highest vertex betweenness on the set of paths from remaining source ASes to the adversary. Intuitively, this is the poison that invalidates the maximum number of source paths not containing the target link. While no guarantee exists that source ASes will select a path that contains the target link, we at least remove a common hop used to avoid the link. Other techniques could weight the scoring based on source AS CAIDA rank, customer cone size, or any number of other factors. The entire algorithm, including this poison scoring technique, is shown in the algorithm block below. A full example of poison scoring is shown in the appendix, Section B.

In the following section, we discuss our experimental setup and present the results of thousands of simulated Maestro attacks. Additionally, we describe a related valley path leak attack that can be used to expose Tier 1 to Tier 1 peer links to devastating attack flows.

5. Evaluation

5.1. Simulation Methodology

Realistic, active measurement of an attack like Maestro on the Internet would present serious ethical challenges in both control- and data-plane disruption. Instead, we evaluate Maestro by extending the Chaos BGP simulator used in previous related work (Tran et al., 2019; Smith and Schuchard, 2018; Schuchard et al., 2012, 2010). This Internet-scale simulator builds a BGP topology based on publicly available, state-of-the-art inferred AS relationship data from CAIDA (February 2019 dataset) (at UCSD, 2019). In the simulator, ASes perform a simplified BGP decision process for path selection that includes longest-prefix matching, shortest AS PATH, and abbreviated local policy. As true local AS policies are private, this is the most accurate simulation of AS behavior we can devise. Recent work from Smith et al. (Smith et al., 2019) suggests that short poisoned paths are rarely filtered by ASes, and we will demonstrate that Maestro does not require a long list of poisons. We model our simulator’s poison mechanics based on the live Internet’s treatment of BGP poisoning (Smith et al., 2019) and other work that employs poisoning (Katz-Bassett et al., 2012; Anwar et al., 2015).

For each attack, we use three botnet models based on Mirai, Blackenergy, and Conficker botnet IP measurements. With these models, we can measure pre-attack flow density for a target, which represents the present vulnerability of the link to LFAs. Next, we execute the Maestro attack using the technique detailed in the previous section in an attempt to bring additional bot traffic to bear on the target. Finally, we measure post-attack flow density to determine how well we steered bot-containing ASes onto the target link. For most experiments, we make bot-to-bot (Coremelt-style) flow density measurements; when using bot-to-any target link sample set, we will instead measure bot-to-any flow density.

Our botnet models are built from passive and active measurements of infected hosts from a variety of sources. The Mirai botnet model includes 2.29 million IP addresses in 11,633 ASes. These addresses were recorded by a Chinese CDN as they attempted to spread the malware, a process with a unique signature (Netlab360, 2017). Our Conficker model is composed of 2.28 million bots from 12,095 ASes. The Conficker model is based on prior work that presented a method for detecting rendezvous points for infected hosts and monitoring bot traffic to these points (Thomas and Mohaisen, 2014). The Blackenergy model is a SCADA-focused botnet developed from similar techniques as presented in (Chang et al., 2015). The Blackenergy botnet has a total of 310,943 bots and 4,291 ASes. We present the AS-level distribution of these botnets’ IPs in the appendix, Fig. 16. All three are relatively clustered topologically. Future work could explore Maestro’s affect on differently distributed flow sources, e.g. other botnets or reflection assets.

To evaluate the effectiveness of our attack as presented in Section 4, we choose thousands of target link/adversary AS pairings for simulated attacks. We aim to understand link vulnerability characteristics, and show how the topological position of target/adversary affect flow density. The following sections describe our link sample sets, and how adversaries are selected.

5.2. Link Selection

For the Maestro attack, we only consider customer to provider and provider to customer links. We present a related attack for peer link targets later in this section. Our attacks are conducted on the following target sample sets:

Random: Our first and most straightforward link sample set is 2000 links selected uniformly at random from all links in our inferred topology. The only conditions on these links were that they were 1) not last-mile links, as these can be targeted by a traditional DDoS, and 2) not peer links.

By link betweenness: An important insight of the Crossfire attack is that degrading links in the dense core of the Internet would create broad disruption (Studer and Perrig, 2009). These links are characterized by high betweenness, where betweenness is quantified by the number of times a link appears on best paths between all ASes in the pre-attack inferred topology. So, for our second sample set, we divide links in the CAIDA AS relationship dataset (at UCSD, 2019) by their betweenness decile, and sample 100 links each from 1) below the 1st decile (fringe links), 2) between the 5th and 6th decile (moderately utilized links), and above the 9th decile (core links). This will allow link vulnerability comparison based on path usage.

By bot-to-bot flow density: Our third target link set is also sampled from low, middle, and high decile ranges, but is based on pre-attack bot-to-bot flow density rather than betweenness. For each of our three botnet models, we sample 100 links each from the low, middle, and high decile ranges described in the previous scheme. This will highlight how effective the attack is in both improving the flow density for links with moderate pre-attack exposure, and in exposing links that were previously unreachable by the botmaster.

By bot-to-any flow density: Finally, we build a bot-to-any flow density link sample set, which is constructed exactly as the previous set, but using bot-to-any rather than bot-to-bot flow density.

5.3. Adversary Selection

We must also select the adversary ASes that will be used to issue poisoned advertisements. Intuitively, we expect that an AS’s ability to steer traffic onto a selected link will dissipate with increased topological distance from the link. So, we constrain our adversary selection to ASes that are within 3 topological hops of the target link - roughly the average BGP path length (RIPE, 2012). To establish how distance affects attack success, we sample adversary ASes from one, two, and three hops distant from the target link.

General selection: In this method, we only constrain adversary selection to those ASes that lie within 3 hops along valley-free paths from the To AS. Because path export rules are different for providers, customers, and peers (see Section 2.1), the prevalence of attack paths may be affected by AS relationships. Recall that attack paths are available, valley-free paths from malicious flow sources (like bot-infested ASes) to the adversary AS that cross the target link. Note that these are not necessarily currently used best-paths, but simply some valid path that sources could choose to reach the adversary. To explore these dynamics, we ensure that ASes connected to the To AS via customers, peers, and providers (ASes in the customer, peer, and provider adversarial regions) are represented in the sampling. Figure 4 shows an example sampling respecting these considerations. Note that sampling for a customer to provider link is depicted; only the customer region is available for provider to customer targets due to BGP path export rules.

Customer-only selection: The customer cone of an AS has the highest possible visibility of routes exported from the AS; naturally, the AS seeks to provide its customers with all of its known best paths in hopes of transiting customer traffic to the maximum number of destinations. For customer-only selection, we limit adversary sampling to those within 3 hops in the To AS customer cone. We expect that these ASes will have the maximum number of attack paths among all potential attackers. For a depiction of this type of sampling, see 5. Note that this selection type produces a subset of the adversaries selected by the general selection method.

The above methods for sampling adversaries and links will be combined in the following experiments to elucidate success conditions for a Maestro attacker.

5.4. Random Attacks

In this first experiment, we set out to discover patterns in successful attacker/target pairings to guide further experimentation. We simulated attacks on 2000 links sampled from the topology according to the random selection scheme from Section 5.2. Adversaries were selected via general adversary selection as described in Section 5.3, with three adversaries sampled at each depth 1-3 from each adversarial region (ASes reached from customers, providers, or peers of the To AS). This yields a total of about 27 attackers per link. Note that there will be fewer attackers when the To AS has a limited number of customers/providers/peers from which to sample. The results are shown in Fig. 6.

We make two observations about this initial experiment. First, we see that results from each of our three botnet models indicate similar steering behavior despite their differing topological distributions of infected hosts. This dynamic is consistent across all of our experiments, so we will henceforth only display results for the Mirai model. Graphs for the other botnets will be included in the appendix for completeness.

Secondly, we see that these results are frankly underwhelming. For more than 80% of sampled targets, no improvement was seen in flow density after the attack. An analysis of the few successful cases, however, revealed some important common factors. Successful adversaries were almost always close to (within 3 topological hops of) the target link, confirming our suspicion that distance was likely to play a major role in moving traffic.

Interestingly, successful attackers were almost universally located in the customer cone of the target link destination (the To AS). This is because path export rules are most generous for customers. By locating the adversary in the customer cone of the target endpoint, we maximize attack path viability on the adversary’s side of the link - because all links from the target to a direct/indirect customer adversary are provider to customer links, paths from the To AS to that adversary are naturally valley-free. Our next experiment is designed to focus our effort on adversaries in the customer cone.

5.5. Customer Cone Attack

In this section, we present results for betweenness, bot-to-bot flow density, and bot-to-any flow density target link selection with customer only adversary selection as described in Sections 5.2 and 5.3. By sampling 100 links each with relatively low, intermediate, and high betweenness/flow-density, we seek to illustrate how the attack performs on targets with different characteristics. Selecting only direct/indirect customers of the To AS as adversaries allows us to maximize the number of available attack paths on the adversary’s side of the link.

As in the previous experiment, three adversaries are sampled from each depth 1-3 in the To AS customer cone. This results in about 1800 adversary/link pairings per link sample set, for about 5400 total simulated attacks. The results are shown in Figures 8a and  8b. The adversary’s expected success in this case is dramatically improved; for direct customers of high betweenness links, the average flow density gain is greater than 30 percent (Fig. 8b). Note that this figure is not percent gain relative to existing flow density - rather, an additional 30 percent of the entire botnet is brought on to the target. For low betweenness links, attack impact is negligible, but this is neither surprising nor particularly interesting; these links are not primary targets for LFAs.

A deeper examination of the data yields some critical insights about the shape of a successful Maestro scenario. One of the most important is that target link relationship is critical to attack success. For an adversary in the To AS customer cone, attack paths are more available when the To AS is a customer of the From AS; that is, the target link is a provider to customer link. This is an intuitive finding; any bot AS that must transit a provider to customer link to reach the target link cannot then transit a customer to provider link and remain valley-free. Like locating the adversary in the To AS customer cone, targeting a provider to customer link removes a potential valley from attack paths, but at rather than after the target link. The importance of this dynamic is shown in Fig. 8c - this violin plot shows the relative distribution of flow density gains by link relationship. Virtually all successful cases for this experiment were on provider to customer links. The relatively rare conditions for success in the customer to provider case are examined in the next experiment.

Fig 8a displays pre vs. post attack flow density for the same betweenness link sample in Fig 7a, filtered to include only provider to customer links. Here we see results for the ideal case for the attack: an adversary AS located in the customer cone of the To AS, when the target link is a provider to customer link. Note that the region between the curves in this figure represents the attacker’s gain from executing the Maestro attack. Before the attack, most sampled links have flow densities below 10% - that is, most link targets are vulnerable to 10% or less of infected hosts in a Coremelt LFA. After Maestro is executed, roughly half of sampled links have flow densities of 50% or higher.

While this experiment demonstrates the ideal scenario for a Maestro attack, the following studies explore how an adversary can affect other likely targets, including provider to customer and core peer links.

5.6. Customer to Provider Link Attacks

In our previous experiments, we have examined the role that target link relationship and adversary position play in the prevalence of attack paths. Since most Internet services require bidirectional communication, the simplest method for attacking customer to provider links is to attack the opposite direction; i.e., target the associated provider to customer link. To confirm the viability of this method, we reversed the target link direction for all customer to provider links from our betweenness link sample set that resulted in less than 1% post-attack flow density in the prior experiment. We re-sampled adversaries from the new To AS customer cones and simulated attacks on this target set. Fig. 9a shows the results of these reversed attacks. Clearly, link relationship was the primary culprit preventing attack success; attacking in the reversed direction yields drastically improved flow density. For most links, we saw 50% or greater post-attack flow density, meaning we expect to engineer most infected host paths in the botnet onto the target.

In the case where an adversary has compromised an AS in the To AS customer cone of a customer to provider link, though, the adversary may not be able to simply attack the reversed direction; this requires compromising a different AS. So, we ask now under what conditions the customer to provider direction can be successfully attacked. The only attack paths available in this case originate from within the From AS customer cone, because any flow sources not located there must transit a peering or provider to customer link before reaching the target link. This means that potential targets are limited to those with significantly bot-infected From AS customer cones.

To test our ability to steer bot traffic in these scenarios, we randomly sampled 300 links from between the 9th and 10th deciles for From AS customer cone infection rate from the set of all customer to provider links, simulated attacks, and measured flow density improvement. The results are shown in Fig. 9b. While these results are not as dramatic as the prior experiment, we find that we are able to exert significant steering behavior on bots in the From AS customer cone.

5.7. Peer Link Attacks

None of our studies have targeted peer links. In the CAIDA inferred topology, however, about 410,000 of the 660,000 total Internet links are peering links. These links play a critical role in transiting traffic between Tier 1 providers in the Internet’s core. Like customer to provider links, attack path viability in this case is limited by BGP path export rules. Unlike those targets, however, we cannot simply reverse the direction of the attack; peer link export rules are the same for both endpoints. A Maestro attacker is therefore limited to bot flow sources that exist inside the From AS customer cone. As in the previous experiment, we can often effectively steer traffic sourced from within the From AS customer cone; we leave the presentation to our appendix in Figure 15.

We observe, however, that an AS located in the From AS customer cone of a peer link target is not limited to the Maestro attack. An adversary who has compromised such an AS has a much simpler means of altering the control-plane to increase flows: leaking valley paths that cross the target link. By leaking, we mean that the adversary AS advertises to its other upstream providers/peers valley paths from itself over the target link to bot-infected prefixes in the To AS customer cone. Normally, these paths would only be advertised to the compromised AS’s customers; the compromised AS has no interest in transiting traffic between providers at its own expense. But if the AS has been compromised by an adversary, or the AS’s operators value attacking the target link above the cost of the attack traffic, this technique could be an effective means of exposing the peer leak to malicious flows. Figures 10a and 10b illustrate this technique, which we term a leak attack. While we only evaluate the leak attack in the context of peer links, an adversary could similarly leak a customer to provider link.

Unlike the Maestro attack, leak attack traffic transits the adversary AS before crossing the target link. So, this attack is limited in flow density improvement by the capacity of the adversary AS’ inbound links, as well as the capacity of links between the adversary AS and the From AS (its direct or indirect provider). Of course, the attacker does not need to consume the entire capacity of the target peer link - only to increase flow density such that normal and malicious traffic together exhaust link capacity. Here we present results without consideration for potential pre-target bottlenecks, with an examination of relative link capacities left to future work.

We evaluate this leak attack on the Tier 1 clique; that is, all 400 peer links connecting the 20 Tier 1 providers. For each target link, we sample adversaries from 1-3 hops in the From AS customer cone, and measure bot-to-bot flow density before and after the adversary AS leaks all routes containing the target link. Fig. 10c shows the pre vs. post attack CDF by flow density for these simulations. According to CAIDA’s inferred topology and our real-world botnet IP mappings, these critical links in the Internet’s core are almost completely isolated from potential LFA traffic before the attack. Under all botnet models, we were able to see significant improvements. For the Mirai botnet, for instance, roughly half of Tier 1 link/adversary AS pairings had post-attack flow densities of 20% or greater. Notably, these Tier 1 to Tier 1 links have virtually no vulnerability before the attack, and 50%+ or greater exposure to IPs in major botnets after leak execution from a small customer.

Given the differing performance of the Maestro attack under varied link and adversary selection scenarios, we will present a summary of attack results and perform further statistical analysis to better understand link vulnerability characteristics.

6. Attack Scope and Vulnerability

As shown in Section 5, the general conditions under which we can expect success as a Maestro adversary are: 1) target a provider to customer link and 2) compromise a direct/indirect customer of the To AS. We present a table to summarize the results of the Maestro attack on provider to customer links from our betweenness link sample, Table 1. This table displays the proportion of links from the sample that an adversary can achieve a targeted bot-to-bot flow density level on, called the  vulnerability threshold, before and after attack execution. Observe that 50% or less of links in this sample have 25% or greater pre-attack flow density across all botnet models; after the attack, greater than 95% of these links are above this threshold.

The adversary sample set columns display, for each vulnerability threshold, the average set size for the number of potential ASes that an adversary could compromise to perform the attack. To calculate this number, we first note that adversary AS size is not a significant determinant of attack success - the absolute value of the correlation coefficient of CAIDA AS rank (CAI, 2019) and flow density gain for these attacks was always smaller than $.01$. Success for adversaries in the customer cone is instead dominated by relative topological position. For this reason, if an AS two hops into the To AS customer cone is successful at a given threshold, we expect every other AS at the same or lower customer cone depth to also successfully execute Maestro at that threshold. Out of about 600 provider to customer attacks in this sample set, we found that fewer than 3% violated this expectation for any botnet model. To that end, we estimate the potential adversary pool as the To AS customer cone to the depth of the deepest successful adversary. The standard deviation is also presented for these adversarial sets. Note that the high variance in set size expressed by these statistics illustrates that the pool of potential adversaries varies greatly. For target links with large ISPs as the To As (like core Internet links), the To AS customer cone can include thousands of potential adversaries. For many smaller targets, only a handful of ASes are well-positioned for the attack.

6.1. Statistical Analysis

In addition to understanding the scope of the attack, we also want to understand adversary AS/target properties that influence attack success. For this purpose, we statistically analyze a set of feature vectors composed of candidate attack success predictors. Using 17,000 simulations of the Maestro attack with randomized link selection and general adversary selection, we extract the following features: BGP best path distance from the adversary to the target link, the topological depth of the adversary in the To AS customer cone, number of bots in the From AS’s customer cone, and the AS ranks of the adversary, From AS, and To AS. We selected these features based on properties that can be easily determined using standard traceroutes and open datasets such as CAIDA’s AS Rank and AS relationships (CAI, 2019; at UCSD, 2019).

Fig. 11 shows a Principal Component Analysis (PCA) algorithm used to rank all prior features by their mean and variance. Higher feature means suggest greater influence on attack success. We find the most important predictor to be the topological depth of the adversary. The least important is the adversary AS rank. Together, these findings demonstrate that topological positioning outweighs adversary AS size in determining attack success - small ASes can conduct the Maestro attack against relatively large transit AS links. The heatmap presented in Figure 8b meshes with the above findings to illustrate how the adversary’s ability to concentrate flows on the target decreases with distance. From this attack analysis, we move to a consideration and evaluation of potential mitigations.

7. Towards Defenses

7.1. Defenses for Presented Attacks

7.1.1. Leak Defense

Leak attack mitigation is a challenging problem. No current, widely deployed method exists to filter advertised valley paths. Worse, ground-truth AS relationships are not publicly available. In fact, valley paths have been observed on the Internet in practice and studied in prior work (Giotsas and Zhou, 2012). The cost of transiting attack traffic over the leaked route could be prohibitive for some adversaries, though this would not dis-incentivize an attacker who has compromised (does not actually own) the AS. The surest defense for upstream providers who wish to defend themselves from this attack is monitoring advertisements from their customer cone for leaked routes. In response to suspect advertisements, the defender could respond by disconnecting the violator.

7.1.2. Maestro Defense

Two broad categories exist for defense against this attack: general LFA defense solutions and solutions targeting the spread of poisoned announcements. Unfortunately, many state-of-the-art defensive options are not widely available to network operators. Some (like CoDef) require collaboration across ASes, a difficult feat in an Internet architecture that does not encourage cooperation (Lee et al., 2013). The next-generation architecture SCION includes mechanisms to solve this and many other routing problems (Basescu et al., 2016); unfortunately, SCION has yet to see broad deployment. Promising SDN-based LFA mitigations have been proposed, but these require infrastructure capabilities currently unavailable to most operators (Kang et al., 2016; Liaskos et al., 2016). Nyx, a re-routing system itself based on BGP poisoning (Smith and Schuchard, 2018) could partially mitigate Maestro for a single deployer AS and some chosen critical AS, but the target link would still be affected for all other AS pairings.

The second and more relevant category of mitigations target Maestro’s poisoned advertisements. Note that Route Origin Authorization would not disrupt this attack, as the compromised AS owns the advertised destination prefixes (Lepinski et al., 2012). BGPSEC, if widely deployed, could prevent this kind of AS PATH tampering; unfortunately, it is not deployed at scale nor effective with partial deployment (Goldberg, 2014). Detecting or filtering advertisements by individual network operators is the most straightforward approach to countering Maestro. However, some proposed DDoS mitigation (Smith and Schuchard, 2018) and link failure response (Katz-Bassett et al., 2012) systems rely on BGP poisoning, and network operators sometimes employ it for traffic engineering (Roughan et al., 2011). Filtering all BGP poisons, then, may have some cost. Alternatively, path length limiting could be an effective mitigation, as each poison required to steer flows increments the path length of the poisoned advertisement. In order to determine which mitigations are most appropriate, we examined these options in the Chaos simulator with the same attack mechanics presented earlier.

As with the peer link, the most effective defense across botnet models is careful monitoring of downstream advertisements. The major threat from this attack is from within link endpoints’ own customer cone. While this is a higher cost activity than simply implementing a filtering rule, it means that ASes can act in their own self-interest to defend their own links from Maestro attacks.

7.2. Poison-Focused Defenses Evaluation

7.2.1. Path Length Defense

The path length defense - rejecting advertisements above some limit - is one easy-to-implement response to this attack. Unfortunately, as shown in Fig. 12a, nearly all of the attack effect is achieved with 5 or fewer poisons; this is partially an artifact of relatively dense botnet distributions as discussed in the next mitigation. Prior work from Tran et al. (Tran et al., 2019) observed AS PATH lengths commonly reach 30 hops in legitimate advertisements, indicating that adding 5 hops to the AS PATH is likely not sufficient to distinguish attack advertisements. So, a defense based strictly on path length is probably not feasible. Fig. 12b shows the effect if all ASes limited advertisement AS PATH length at various levels, including those observed by prior work (30 and 75) and implemented in common routing hardware (254) (Ivan Pepelnjak, 2009). In short, these limits do not decrease the achieved flow density.

7.2.2. Poison Filtering Defense

ASes could also prevent this attack by filtering advertisements with poisons. This is a feasible approach, because poisoned advertisements have a clear signature - AS PATHs that include a list of poisoned ASes between copies of the originator’s ASN. If all ASes on the Internet filtered poisons, the Maestro attack would have no effect. However, as previously discussed, this could have some cost on benign traffic engineering. ASes are also generally under unique administrative control, so operator outreach and deployment is a challenge.

Fig. 12c shows how our betweenness-based link selection/customer only adversary selection experiment responds to different sets of filtering ASes. For this mitigation trial, we ran our attack against four filtering sets. The first two sets are composed of 25% and 50% of all transit ASes (those with one or more customers) filtering all poisoned advertisements. The next two sets are smaller but more strategically targeted. We include a set of all 20 Tier 1 ASes to quantify how well the largest and most influential providers can protect the Internet as a whole.

Finally, we explore a botnet-specific defense designed from the observation that the bulk of infected hosts in all three botnet models are concentrated in relatively few ASes (for detail on botnet distributions, see Fig. 16 in the appendix). In the Mirai model, for example, 64% of the botnet is hosted in 30 ASes. So, for our final filtering set, we include all providers (58) for these 30 ASes. In effect, those 58 providers form a poisoned advertisement cordon or barrier around the botnet’s core to prevent path steering for the majority of infected hosts. While cordoning is a botnet-specific defense, it illustrates how a handful of well-positioned filterers is orders of magnitude more effective per AS deployer than many randomly distributed ones. Both the 50% transit and Mirai cordon filtering sets eliminate virtually all Maestro flow density gains. Interestingly, filtering at all Tier 1s (20 ASes) provides greater overall reduction in flow density than filtering at 25% of all transit providers (2441 ASes). Unfortunately, prior work indicates that filtering short poisoned announcements under lengths of 50 ASes rarely occurs in practice (Smith et al., 2019; Tran et al., 2019).

7.3. Ethics and Operator Engagement

As described in Section 5, all experiments were performed in simulation; no production networks were adversely affected. Additionally, we submitted a preprint to the NANOG (North American Network Operators Group) mailing list to solicit feedback on the attack and disseminate mitigations. Responses indicated that operators had not seen any similar attack executed in practice. Some operators suggested that the "peer lock" mechanism, widely deployed by the largest providers, could provide some protection from the attack (pee, 2016). Hurricane Electric lists peer locking as an upcoming feature in their filtering algorithm (Hurricane Electric, [n. d.]). Peer locking validates advertisements against known relationships, an intuitive step in averting path manipulations like those used in Maestro. However, this requires periodic out-of-band information exchange between ASes, and it is unclear how far this feature has penetrated beyond Tier 1 ASes. We leave to future work a full quantification of this tool’s impact on Maestro, though note that our Tier 1 filtering examination from Fig. 12c should provide a similar result if peer locking deployment is limited mostly to Tier 1 providers.

8. Related Work

The Coremelt (Studer and Perrig, 2009) and Crossfire (Kang et al., 2013) attacks are discussed in detail in the background, Section 2.3. Classifying links by BGP betweenness is a technique employed by in Schuchard et al.’s Losing Control of the Internet (LCI) attack on the BGP control-plane (Schuchard et al., 2010). Interestingly, the LCI attack used the control-plane to attack the data-plane; here, we leverage the control-plane to augment a data-plane attack. LFA mitigation work that applies to this attack is presented earlier during the mitigation discussion, Section 7.

Other uses of BGP poisoning include LIFEGUARD from Katz-Bassett et al. (Katz-Bassett et al., 2010, 2012) as well as Anwar et al.’s policy exploration (Anwar et al., 2015). Nyx (Smith and Schuchard, 2018) from Smith et al. employs BGP poisoning for DDoS mitigation. In (Colitti et al., 2006), Colitti et al. use poisoning for route discovery similar to Anwar et al. (Anwar et al., 2015). The propagation of poisoned advertisements throughout the Internet is actively measured in (Smith et al., 2019), which informs us regarding how BGP operators respond to such advertisements in practice.

9. Conclusion

In this work we explored both the limitations of LFAs launched by botnets, and approaches adversaries have to overcome these limitations with control of a BGP speaker. Our experiments showed that contrary to assumptions in previous literature, botnet-sourced LFAs cannot target arbitrary links with full force in practice. In fact, many core Internet links can be reached by just a fraction of infected hosts in all three of our botnet models. Our simulations show that the Maestro attack can partially overcome these reach restrictions. Most troublingly, high betweenness links (core) are most vulnerable to this attack, and the rank of AS adversaries plays little role in attack success. Provider to customer targets are far more vulnerable to a Maestro attack, but customer to provider and peer links with significantly infected From AS customer cones can be affected by Maestro, as well. Additionally, both could be subject to leak attacks that expose them to malicious flows. Our exploration of defenses suggests poison filtering at topologically strategic points drastically reduces vulnerability.

Future Work: 1) Improvements to our poison scoring heuristic could be explored. The version we employed for experiments weighs all source ASes equally when making poisoning decisions; infected hosts, on the other hand, are not uniformly distributed throughout the Internet topology. 2) The use of multiple prefixes independently could improve adversarial success by eliminating poison set conflicts, and could be used to attacking multiple links for a more sophisticated isolating LFA. 3) Botnets are not the only sources of malicious flows. Maestro can be used to steer any attack flows directed to the adversary AS; this could include normal inbound traffic for a large adversary AS, or reflection-generated flows (Majkowski, 2018).

Appendix A Optimal Poison Choice

We do not utilize this method in practice because it has high runtime complexity and does not exploit the specific structure of our problem.

We can solve for the optimal poison set by re-framing the problem as MAX-SAT, a generalization of boolean satisfiability (SAT) where we seek to assign truth values to variables in order to maximize the number of satisfied clauses rather than achieve complete boolean formula satisfaction (Vazirani, 2013). Consider that each source AS has a set of poison sets $S$ that map to resulting paths $P$ over the target link to the adversary AS, where each set $s$ $\in$ $S$ corresponds to a resulting path to the poisoning prefix $p$ $\in$ $P$ (that is, $s$ $\mapsto$ $p$ for that source AS). This signifies that if the adversary chooses a poison set that contains all of the ASes in $s$ and none of the ASes in $p$, the source AS will shift onto path $p$. Note that, depending on the adversary AS and target link position relative to the source AS, $S$ and $P$ may be empty; in that case, there is no way to steer the source AS onto the target link.

In the boolean formula for a problem instance, the variables will be the ASes in the topology. We can define the structure of the boolean formula by building a clause for each source AS thusly: an AS appearing in a poison $s$ is represented by its AS variable, and the ASes in the resulting path $p$ are represented by the inversion of their AS variables. These variables are joined conjunctively, along with the source AS itself; if it is poisoned, it will of course not have a path to the poisoned prefix. We disjunctively join each source AS’s conjunctive clauses, one for each $s$ $\mapsto$ $p$, to form a clause in disjunctively normal form for that source AS. This clause is the boolean representation of the poison choices we must make to bring the source AS onto the target link.

Finally, we join the all source AS clauses by conjunction, and we have defined a boolean formula that describes how our poison choices will affect the paths of ASes containing bots to the adversary. While we do not reformulate the problem in conjunctive normal form, it is always possible to do so (Kalish et al., 1964).

Unfortunately, MAX SAT is APX-complete; no efficient algorithm can solve it, and no polynomial time approximation scheme can be devised (unless $P=NP$) (Cohen et al., 2004). This is problematic because exploring how the relative topological position of the adversary, target, and flow sources requires the simulation of thousands of attacks. We also note that while we can perfectly map poison choices to resultant paths in the Chaos simulator, AS policy choices are not publicly known and can be changed at any time. Without this information, the "ideal" poison set cannot be computed. So, this optimal choice algorithm is unused in our experiments.

Appendix B Example Attack

To further elucidate our heuristic approach, we present an example attack on a small toy topology in Fig 17. ASes above (closer to the top) of the figure provide for the linked ASes below them. Each subfigure displays the results at one iteration (after the initial depiction of the topology), with the betweeenness-based poison score displayed in red for select high score ASes.

Appendix C Supplementary Evaluations

Here we present similar experiments to Section 5 for other botnet models - Conficker and Blackenergy. These results generally exhibit the same patterns as those found in that section.