TWC: TTP Option: Small: Collaborative: Detecting and Characterizing Internet Traffic Interception Based on BGP Hijacking

最近的报告强调了通过重新路由跨越地球仪的边界网关协议（BGP）路径而执行的大规模互联网流量拦截的事件（影响银行、政府、整个网络服务提供商等）。这些攻击的潜在影响可以从大规模窃听到身份欺骗或选择性内容修改。此外，实施这种攻击并不需要进入或接近受影响的链路和网络，这对国家安全构成越来越大的风险。更糟糕的是，互联网流量拦截的影响几乎是未知的，即使是大规模和长期的事件显然也没有被受害者注意到。由于在全球范围内涉及复杂的动态和不同行为者的数量，为交通拦截事件的检测和定性设计有效的方法需要经验和及时的数据（例如，当事件仍在进行时获得）。这些数据必须是被动BGP测量和主动测量（如Traceroute）的组合，因为触发攻击的机制在域间路由控制平面上运行，但实际影响仅在数据平面上可验证。通过利用我们的测量和数据处理基础设施，该项目旨在：（i）调查，开发和实验评估新的方法来自动检测流量拦截事件，并描述其程度，频率和影响;（ii）扩展研究团队的测量基础设施，以近实时检测和报告基于BGP劫持的流量拦截事件;以及（iii）记录此类事件，向研究人员提供数据集，并向运营商、应急响应团队、执法机构和决策者提供汇总统计数据和报告。

Recent reports have highlighted incidents of massive Internet traffic interception executed by re-routing Border Gateway Protocol (BGP) paths across the globe (affecting banks, governments, entire network service providers, etc.). The potential impact of these attacks can range from massive eavesdropping to identity-spoofing or selective content modification. In addition, executing such attacks does not require access or proximity to the affected links and networks, posing increasing risks to national security. Worse yet, the impact of traffic interception on the Internet is practically unknown, with even large-scale and long-lasting events apparently going unnoticed by the victims. Because of the complex dynamics and number of different actors involved on a global scale, devising effective methodologies for the detection and characterization of traffic interception events requires empirical and timely data (e.g., acquired while the event is still ongoing). Such data must be a combination of passive BGP measurements and active measurements (such as Traceroute), since the mechanism triggering the attack operates on the inter-domain routing control plane, but the actual impact is only verifiable in the data plane. By leveraging our measurement and data processing infrastructure, this project aims to: (i) investigate, develop, and experimentally evaluate novel methodologies to automatically detect traffic interception events and to characterize their extent, frequency, and impact; (ii) extend the research team's measurement infrastructure to detect in near-real-time and report episodes of traffic interception based on BGP hijacking; and (iii) document such events, providing datasets to researchers and summary statistics and reports to operators, emergency response teams, law enforcement agencies, and policy makers.