Modular platform for detection of BGP routing attacks

• Autor(a) principal: Silva, Marco Filipe Moutinho da
• Data de Publicação: 2017
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10773/24811

In order for Internet connectivity to be possible, routing protocols have been created to assist in this task. The global routing protocol in use is BGP, which uses the aggregation of several network prefixes into ASes to create a graph containing information regarding routes to all public network prefixes, leading to global connectivity. Despite serving its purpose, this protocol is based on blind trust between all the BGP peers and as such leaves it exposed to attacks. Since this protocol is responsible for global connectivity, an attack carried on this protocol can have traffic re-routed from its normal path, and right into the attackers’ hands, which may then be able to read and or alter the information contained in the traffic. Although security measures have been created for this protocol, they are not widely deployed, and, as such, most of the BGP devices’ routing tables can still be compromised by a rogue BGP peer. ISPs have ways to detect these kind of attacks, and act upon them but the users, such as private users or companies, are left at the mercy of their ISPs ability to detect and notify their clients of such attacks. That being the case, this dissertation proposes a platform capable of monitoring networks in order to detect BGP routing attacks. The platform has been made as modular as possible, to facilitate changes, and addition of new methods to detect such anomalies, and has also implemented two different methodologies for the detection of BGP routing anomalies. One of them based in an already published paper while the other one is proposed by the author of this dissertation. From data collection with the use of several probes, to the analysis of said data to detect the anomalies, all of that will be presented and explained to demonstrate that the platform does indeed detect BGP routing attacks with an accuracy of over 90%. This platform can then help the users to defend themselves against such attacks, by providing information of when those are happening in near realtime as well as allow for the deployment of custom countermeasures, which can be set to activate when an alarm is raised, giving more control to the users and making them less reliant on their ISPs for information and action.