Oscilloscope: Detecting BGP Hijacks in the Data Plane
Tobias B\"uhler, Alexandros Milolidakis, Romain Jacob, Marco Chiesa,, Stefano Vissicchio, Laurent Vanbever

TL;DR
Oscilloscope is a real-time traffic analysis method that detects BGP hijacks by identifying traffic pattern changes specific to hijacking events, effectively filtering out normal network variations.
Contribution
It introduces a novel traffic-based detection approach that distinguishes hijacks from normal network events by analyzing traffic change patterns across related prefixes.
Findings
Accurately detects BGP hijacks in realistic traffic traces.
Reduces false positives by filtering normal network events.
Detects hijacks quickly and reliably.
Abstract
The lack of security of the Internet routing protocol (BGP) has allowed attackers to divert Internet traffic and consequently perpetrate service disruptions, monetary frauds, and even citizen surveillance for decades. State-of-the-art defenses rely on geo-distributed BGP monitors to detect rogue BGP announcements. As we show, though, attackers can easily evade detection by engineering their announcements. This paper presents Oscilloscope, an approach to accurately detect BGP hijacks by relying on real-time traffic analysis. As hijacks inevitably change the characteristics of the diverted traffic, the key idea is to track these changes in real time and flag them. The main challenge is that "normal" Internet events (e.g., network reconfigurations, link failures, load balancing) also change the underlying traffic characteristics - and they are way more frequent than hijacks. Naive…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Network Packet Processing and Optimization
