NeTS: Small: Buddyguard - A Buddy System for Reliable IP Prefix Monitoring

由于操作失误或安全攻击，每个Internet IP前缀（即每个IP地址块）都可能经历各种路由异常，从而导致业务损失、身份盗窃或许多其他破坏性影响。例如，在前缀劫持中，攻击者可以劫持对前缀的合法用户的流量。然而，一种既能有效监控异常又能抵御攻击者规避的解决方案尚未出现。本研究将调查、设计和评估一种可靠监测IP前缀的新方法。它被称为Buddyguard，它用由伙伴前缀或伙伴组成的伙伴系统包围前缀，并监视前缀与其伙伴的行为。科学贡献将包括：(i) Buddyguard架构，用于监测IP前缀的路由异常情况，包括各种困难的前缀劫持情况；（ii）伙伴发现、选择和维护算法，为监控的前缀选择伙伴，包括严格分析需要什么和多少伙伴才能有效地检测路由异常并抵御攻击者？规避;（iii）使用前缀的可扩展且易于部署的算法？S伙伴可靠、快速、弹性地检测路由异常；（iv）对使用伙伴系统进行前缀监测的可行性、优点、性能和局限性有深入透彻的了解。Buddyguard一旦部署，将作为一项服务提供给公众。这项研究的结果以及工具、软件代码和文档也将被传播。这项研究还包括一个坚实的课程和教育计划。

Because of operational malpractice or security attacks, every Internet IP prefix (i.e., every block of IP addresses) can undergo various routing anomalies, causing business loss, identity theft, or many other devastating effects. For example, in prefix hijacking, an attacker can hijack traffic toward legitimate users of a prefix. However, a solution that is both effective in monitoring anomalies and resilient against attacker circumvention is yet to be seen. This research will investigate, design, and evaluate a new approach to reliable monitoring of IP prefixes. Dubbed Buddyguard, it surrounds a prefix with a buddy system composed of buddy prefixes, or buddies, and monitors the behavior of the prefix against its buddies. The scientific contributions will include: (i) A Buddyguard architecture for monitoring routing anomalies of IP prefixes, including various difficult prefix hijacking cases; (ii) A buddy discovery, selection and maintenance algorithm to choose buddies for a monitored prefix, including a rigorous analysis on what and how many buddies are needed to effectively detect routing anomalies and be resilient against attackers? circumvention; (iii) A scalable and easy-to-deploy algorithm to use a prefix?s buddies to detect routing anomalies reliably, quickly, and resiliently; and (iv) A deep and thorough understanding on the feasibility, advantages, performance, and limitations of using a buddy system for prefix monitoring. Once deployed, Buddyguard will be offered as a service to the public. The results as well as tools, software code, and documents from this research will also be disseminated. This research also incorporates a solid curriculum and education plan.