TWC: TTP Option: Small: Collaborative: Detecting and Characterizing Internet Traffic Interception Based on BGP Hijacking

最近的报告强调了通过在全球范围内重新路由边界网关协议(BGP)路径来执行大规模互联网流量拦截的事件(影响到银行、政府、整个网络服务提供商等)。这些攻击的潜在影响范围从大规模窃听到身份欺骗或选择性的内容修改。此外，实施此类攻击不需要进入或接近受影响的链接和网络，对国家安全构成越来越大的风险。更糟糕的是，流量拦截对互联网的影响几乎是未知的，即使是大规模和持续时间较长的事件显然也没有被受害者注意到。由于全球范围内涉及的复杂动态和不同行为者的数量，设计有效的流量拦截事件检测和表征方法需要经验和及时的数据(例如，在事件仍在进行时获取)。这些数据必须是被动BGP测量和主动测量(如Traceroute)的组合，因为触发攻击的机制运行在域间路由控制平面上，但实际影响只能在数据平面上验证。通过利用我们的测量和数据处理基础设施，本项目旨在：(I)调查、开发和实验评估新的方法，以自动检测流量拦截事件，并表征其范围、频率和影响；(Ii)扩展研究团队的测量基础设施，以近实时检测和报告基于BGP劫持的流量拦截事件；以及(3)记录此类事件，向研究人员提供数据集，并向运营商、应急小组、执法机构和政策制定者提供汇总统计数据和报告。

Recent reports have highlighted incidents of massive Internet traffic interception executed by re-routing Border Gateway Protocol (BGP) paths across the globe (affecting banks, governments, entire network service providers, etc.). The potential impact of these attacks can range from massive eavesdropping to identity-spoofing or selective content modification. In addition, executing such attacks does not require access or proximity to the affected links and networks, posing increasing risks to national security. Worse yet, the impact of traffic interception on the Internet is practically unknown, with even large-scale and long-lasting events apparently going unnoticed by the victims.Because of the complex dynamics and number of different actors involved on a global scale, devising effective methodologies for the detection and characterization of traffic interception events requires empirical and timely data (e.g., acquired while the event is still ongoing). Such data must be a combination of passive BGP measurements and active measurements (such as Traceroute), since the mechanism triggering the attack operates on the inter-domain routing control plane, but the actual impact is only verifiable in the data plane.By leveraging our measurement and data processing infrastructure, this project aims to: (i) investigate, develop, and experimentally evaluate novel methodologies to automatically detect traffic interception events and to characterize their extent, frequency, and impact; (ii) extend the research team's measurement infrastructure to detect in near-real-time and report episodes of traffic interception based on BGP hijacking; and (iii) document such events, providing datasets to researchers and summary statistics and reports to operators, emergency response teams, law enforcement agencies, and policy makers.