A Survey of Advanced Border Gateway Protocol Attack Detection Techniques

Area of Science:

• Computer Science
• Network Security
• Cybersecurity

Background:

• The Border Gateway Protocol (BGP), the Internet's inter-domain routing system, is inherently insecure.
• Current BGP anomaly detection methods are computationally expensive, require extensive tuning, and focus on single monitoring points, making them vulnerable to sophisticated attacks.
• Existing detection techniques fail against advanced attacks designed to exploit single-observation limitations and evade public routing monitors.

Purpose of the Study:

• To review and categorize BGP attacks by complexity.
• To identify candidate anomaly detection techniques suitable for advanced BGP attack detection.
• To introduce the concept of advanced BGP anomaly detection, emphasizing multi-viewpoint interactions and rapid capabilities.

Main Methods:

• A comprehensive survey and evaluation of 178 anomaly detection techniques.
• Categorization of BGP attacks based on their complexity.
• Exploratory investigation into advanced BGP attack candidates.

Main Results:

• Identified limitations of current BGP security measures against advanced threats.
• Highlighted the need for lightweight, rapid, and multi-viewpoint detection capabilities.
• Preliminary findings on candidate techniques for advanced BGP anomaly detection.

Conclusions:

• Advanced BGP attacks necessitate a shift towards multi-viewpoint, dynamic analysis.
• The proposed advanced BGP anomaly detection approach offers a promising direction for enhancing Internet routing security.
• Further research is needed to validate and implement these advanced detection strategies.