Ares: Comprehensive Path Hijacking Detection via Routing Tree
summary
Ares detects path hijacking by flagging newly observed prefix routing trees and comparing them to historical trees using a weighted edit distance that gives higher cost to rare or geographically long links; it clusters similar trees to cut comparisons and applies four heuristic filters. Implemented as part of BGP Watch, it detects 12 real-world hijacks within five minutes, achieves 97.2–99.3% recall in simulations against Tier‑1/content victims, 1.06% false positives and ~2.31 alerts/hour.
AI-written summary · about
chapters (13)
- 0:00BGP path hijacking threats
- 1:13Origin vs path hijacking
- 2:38Existing hijack detection limits
- 2:59Ares detection core idea
- 4:25Path hijacking challenges
- 5:07Ares system overview
- 6:14Weighted edit distance for trees
- 7:21Clustering to reduce cost
- 8:45Heuristic filters for false alarms
- 11:19Evaluation on hijack events
- 12:03Simulation results
- 13:53Real-world BGP changes
- 14:57Conclusion and future work
related talks
21mStealth BGP Hijacks with uRPF Filtering
16mA System to Detect Forged-Origin BGP Hijacks
21mAAsclepius: Monitoring, Diagnosing, and Detouring at the Internet Peering Edge
35mRoute to Bugs: Analyzing the Security of BGP Message Parsing
20mContra: A Programmable System for Performance aware Routing
32mLet's talk about routing security
45mFinding Our Path: How We're Trying to Improve Active Directory Security
15mArtemis: Toward Accurate Detection of Server-Side Request Forgeries through(…)