TWC: TTP Option: Small: Collaborative: Detecting and Characterizing Internet Traffic Interception Based on BGP Hijacking

TWC：TTP 选项：小：协作：基于 BGP 劫持检测和表征互联网流量拦截

• 批准号: 1422566
• 负责人: Phillipa Gill
• 金额: $ 17.29万
• 依托单位: SUNY at Stony Brook
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-08-01 至 2017-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1422566&HistoricalAwards=false
• 关键词: TWC; TTP; Option; Small; Collaborative

Recent reports have highlighted incidents of massive Internet traffic interception executed by re-routing Border Gateway Protocol (BGP) paths across the globe (affecting banks, governments, entire network service providers, etc.). The potential impact of these attacks can range from massive eavesdropping to identity-spoofing or selective content modification. In addition, executing such attacks does not require access or proximity to the affected links and networks, posing increasing risks to national security. Worse yet, the impact of traffic interception on the Internet is practically unknown, with even large-scale and long-lasting events apparently going unnoticed by the victims. Because of the complex dynamics and number of different actors involved on a global scale, devising effective methodologies for the detection and characterization of traffic interception events requires empirical and timely data (e.g., acquired while the event is still ongoing). Such data must be a combination of passive BGP measurements and active measurements (such as Traceroute), since the mechanism triggering the attack operates on the inter-domain routing control plane, but the actual impact is only verifiable in the data plane. By leveraging our measurement and data processing infrastructure, this project aims to: (i) investigate, develop, and experimentally evaluate novel methodologies to automatically detect traffic interception events and to characterize their extent, frequency, and impact; (ii) extend the research team's measurement infrastructure to detect in near-real-time and report episodes of traffic interception based on BGP hijacking; and (iii) document such events, providing datasets to researchers and summary statistics and reports to operators, emergency response teams, law enforcement agencies, and policy makers.

最近的报告强调了通过在全球范围内重新路由边界网关协议（BGP）路径执行的大规模互联网流量拦截事件（影响银行，政府，整个网络服务提供商等）。这些攻击的潜在影响范围从大规模窃听到身份欺骗或选择性内容修改。此外，执行此类攻击不需要访问或接近受影响的链路和网络，这对国家安全构成了越来越大的风险。更糟糕的是，流量拦截对互联网的影响实际上是未知的，即使是大规模和持久的事件显然也不会被受害者注意到。由于复杂的动态和全球范围内涉及的不同行动者的数量，设计有效的方法来检测和描述交通拦截事件需要经验和及时的数据（例如，在事件仍在进行时获得的数据）。这些数据必须是BGP被动测量值和主动测量值（如Traceroute）的组合，因为触发攻击的机制是在域间路由控制平面上操作的，但实际影响只能在数据平面上验证。通过利用我们的测量和数据处理基础设施，该项目旨在：(i)调查、开发和实验评估自动检测交通拦截事件并表征其范围、频率和影响的新方法；（ii）扩展研究小组的测量基础设施，以近实时地检测和报告基于BGP劫持的流量拦截事件；（iii）记录此类事件，向研究人员提供数据集，并向运营商、应急响应小组、执法机构和决策者提供汇总统计数据和报告。