Border Gateway Protocol Updates Research Articles

Long-lasting sequences of BGP updates

The Border Gateway Protocol (BGP) is the protocol that makes the various networks composing the Internet communicate to each other. Routers speaking BGP exchange updates to keep the routing up-to-date and allow such communication. This usually is done to reflect changes in the routing configurations or as a consequence of link failures. In the Internet as a whole it is normal that BGP updates are continuously exchanged, but for any specific IP prefix, these updates are supposed to be concentrated in a short time interval that is needed to react to a network change. On the contrary, in this paper we show that there are many IP prefixes involved in quite long sequences consisting of a large number of BGP updates. Namely, examining ∼30 billion updates collected by 172 observation points distributed worldwide, we estimate that almost 30% of them belong to sequences lasting more than one week. Such sequences involve 222285 distinct IP prefixes, approximately one fourth of the number of announced prefixes. We detect such sequences using a method based on the Discrete Wavelet Transform. We publish an online tool for the exploration and visualization of such sequences, which is open to the scientific community for further research. We group together sequences that exhibit common behaviours. For this purpose, we devise a clusterization algorithm able to group the sequences based on their similarity in time. We highlight four categories of clusters, which are attributable to different types of Internet events. Our online tool allows also to explore and to visualize the computed clusters.

Analysis of the regularity of the Internet Interdomain Routing dynamics

The Internet is the product of interconnecting a large number of administratively independent networks. Each such network is referred to as an autonomous system (AS). Moving data traffic between these networks necessitates the presence of a global routing protocol that describes what path needs to be followed to reach a particular destination. The border gateway protocol (BGP) is the de-facto standard global routing protocol and hence the glue that binds the Internet together. Routing devices that use BGP store the current state of the routing systems and dynamically inform neighboring devices, via update messages, upon changes. The stability of BGP is clearly of a paramount importance to the stability of the entire Internet ecosystem. In this work, we aim to better understand BGP dynamics and stability by investigating empirical BGP updates timeseries for regularities. More specifically, we study BGP update timeseries from 4 large autonomous systems that span a four-months period from July 2011 to November 2011. To this end, we employ relevant data analysis methods like Local variation and Lempel and Ziv complexity measure calculations as well as Detrended Fluctuation analysis which allow for assessing the extent of regularity in the considered time series. We also employ the Mahalanobis distance to identify outliers. We find that BGP updates dynamics is characterized by both regular and random-like variability, with the latter coinciding with stronger changes. Furthermore, both regularity assessment and outlier detection methods revealed days with increased extent of order that were common to all four timeseries. Examining these days further indicates the presence of a common global cause. Hence, these methods can be used as a first step for detecting BGP routing anomalies.

A Prefix Hijacking Detection Model Based on the Immune Network Theory

The prefix hijacking problem is an urgent security issue that need to address in the Border Gateway Protocol (BGP) security research. In order to solve the problem of prefix hijacking in BGP, we propose (a) new (p)refix (h)ijacking (d)etection model based on the immune network theory in this paper, called aPHD. To be specific, aPHD uses real BGP UPDATE messages for pre-training and has the ability to detect UPDATE messages in real time after pre-training. The aPHD (1) can effectively detect prefix hijacking attacks with high accuracy; (2)is easy to deployment; and (3) has a low false positive rate and low overhead. Extensive performance evaluation shows that our solution is secure and feasible. The aPHD improved the accuracy rate by 6.2% and reduced the false positive rate by 85.7%.

I-Seismograph: Observing, Measuring, and Analyzing Internet Earthquakes

Disruptive events, such as large-scale power outages, undersea cable cuts, or security attacks, could have an impact on the Internet and cause the Internet to deviate from its normal state of operation, which we also refer to as an “Internet earthquake.” As the Internet is a large, complex moving target, unfortunately little research has been done to define, observe, quantify, and analyze such impact on the Internet, whether it is during a past event period or in real time. In this paper, we devise an Internet seismograph, or I-seismograph , to fill this gap. Since routing is the most basic function of the Internet and the Border Gateway Protocol (BGP) is the de facto standard inter-domain routing protocol, we focus on BGP to observe, measure, and analyze the Internet earthquakes. After defining what an impact to BGP entails, we describe how I-seismograph observes and measures the impact, exemplify its usage during both old and recent disruptive events, and further validate its accuracy and convergency. Finally, we show that I-seismograph can further be used to help analyze what happened to BGP while BGP experienced an impact, including which autonomous systems (AS) were affected most or which AS paths or path segments surged significantly in BGP updates during an Internet earthquake.

Measurement of large-scale BGP events: Definition, detection, and analysis

Measurement on the Border Gateway Protocol (BGP) system is important for understanding the Internet. Many attempts have been made to detect anomalous Internet events through dissecting BGP updates and tables. We notice that most works in this field either deploy/use few monitors or analyze aggregated statistics. Such practices may result in overestimating the impact of monitor-local events, which can be viewed by only a small area.We propose Large-scale BGP Event (LBE), which affects many IP prefixes (high impact) and is widely observable (non-local). To detect LBE, we propose the Update Visibility Matrix (UVM) to record the prefix and monitor related to each update. We formulate the problem of identifying LBE in UVM, which is NP-hard. Then we propose a heuristic algorithm to solve it. We apply the scheme to 2.18 TB of BGP updates and find that the identified LBEs are highly correlated with many well-known disruptive incidents. Besides, we identify 101 LBEs that have never been investigated before. By conducting case studies, we find that the LBEs have high impact and are caused by various reasons. Our work can assist in network/Internet management tasks such as problem prevention, diagnosis, and recovery.

Examining the Jurisdictions of Internet Routes to Prevent Data Exfiltration

We illustrate the option of integrating Internet routing policies with geographic and political restrictions that allow an organization to mitigate network-based data exfiltration. We show that geolocation, jurisdiction and other political considerations can be leveraged real-time during routing decisions. We illustrate the possibility of defensive routing, where organizations (including governments) can identify network paths which create risk of information exposure via transit through specific jurisdictions perceived as risky, and take action to minimize that risk of exposure. Similar to firewalls that allow organizations to block traffic originating from or to specific countries’ IP addresses, our approach allows blocking outbound traffic that will transit specific countries. We show how an organization can select its own routing risk profile without trusting external entities. Other solutions to the challenges of BGP do not thoroughly integrate real world issues of trust and risk, e.g., BGPSEC and RPKI. These solutions also depend on network effects, requiring large-scale adoption. There are significant bodies of research on both the BGP protocol and IP filtering. Our approach is the first to allow an organization to filter its egress traffic based on high-level assertions about the path it will take. In related work geolocation of IP addresses and Autonomous Systems has significantly advanced. We illustrate that the work on geolocation of Internet entities can be used to alter dataflows real time with an implementation of a dynamic politically-aware routing layer. Traditional policy-routing considers stable economic considerations (e.g., customers are preferred over non-customers) and basic path parameters (e.g., path lengths with or without padding). A Border Gateway Protocol (BGP) participant (e.g., ISP) with our system, built on the current network knowledge base, can infer the countries that traffic to a particular destination address will traverse. This is done by inspecting the autonomous system paths advertised via BGP and referencing external data sources about the autonomous systems. Based on this information, an organization can define constraints on its egress traffic to prevent sensitive traffic from being sent via an unexpected or untrusted region of the Internet. In light of the current plethora of route leaks and BGP hijacks this offers a new option to organizations willing to accept potential downtimes. Specifically, organizations can choose to refuse to send traffic via an unacceptable path, instead choosing confidentiality over availability or choosing different routes or technologies. For example, organizations can leverage new SDN techniques to direct traffic via a different path. We demonstrated the feasibility of our described approach with a prototype implementation that receives a stream of BGP updates and generates access control lists (ACLs) to permit or deny egress traffic based on the defined policies. In related work, we illustrate its effectiveness by replaying publicly available BGP update data received from CAIDA and describe the resulting state of the ACLs after known BGP hijack and route-leak events. For this presentation, we present a series of case studies of past BGP hijacks and show how an individual organization can avoid the risks of certain jurisdictions real time.

Long-Range Correlations and Memory in the Dynamics of Internet Interdomain Routing.

Data transfer is one of the main functions of the Internet. The Internet consists of a large number of interconnected subnetworks or domains, known as Autonomous Systems (ASes). Due to privacy and other reasons the information about what route to use to reach devices within other ASes is not readily available to any given AS. The Border Gateway Protocol (BGP) is responsible for discovering and distributing this reachability information to all ASes. Since the topology of the Internet is highly dynamic, all ASes constantly exchange and update this reachability information in small chunks, known as routing control packets or BGP updates. In the view of the quick growth of the Internet there are significant concerns with the scalability of the BGP updates and the efficiency of the BGP routing in general. Motivated by these issues we conduct a systematic time series analysis of BGP update rates. We find that BGP update time series are extremely volatile, exhibit long-term correlations and memory effects, similar to seismic time series, or temperature and stock market price fluctuations. The presented statistical characterization of BGP update dynamics could serve as a basis for validation of existing and developing better models of Internet interdomain routing.

AS-CRED: Reputation and Alert Service for Interdomain Routing

As the backbone routing system of the Internet, the operational aspect of the interdomain routing is highly complex. Building a trustworthy ecosystem for interdomain routing requires the proper maintenance of trust relationships among tens of thousands of peer IP domains called autonomous systems (ASes). ASes today implicitly trust any routing information received from other ASes as part of border gateway protocol (BGP) updates. Such blind trust is problematic given the dramatic rise in the number of anomalous updates being disseminated, which pose grave security consequences for the interdomain routing operation. In this paper, we present AS-CRED, an AS reputation and alert service that not only detects anomalous BGP updates, but also provides a quantitative view of AS' tendencies to perpetrate anomalous behavior. AS-CRED focuses on detecting two types of anomalous updates: 1) hijacked updates where ASes announcing a prefix that they do not own, and 2) vacillating updates that are part of a quick succession of announcements and withdrawals involving a specific prefix, rendering the information practically ineffective for routing. AS-CRED works by analyzing the past updates announced by ASes for the presence of these anomalies. Based on this analysis, it generates AS reputation values that provide an aggregate and quantitative view of the AS' anomalous behavior history. The reputation values are then used in a tiered alert system for tracking any subsequent anomalous updates observed. Analyzing AS-CRED's operation with real-world BGP traffic over six months, we demonstrate the effectiveness and improvement of the proposed approach over similar alert systems.

On the extent of correlation in BGP updates in the Internet and what it tells us about locality of BGP routing events

The Border Gateway Protocol (BGP) is the core routing protocol in the Internet. It maintains reachability information towards IP networks, called prefixes. The adoption of BGP has come at a price: a steady growth in the routing table size (Meng et al., 2005) [1] as well as BGP updates (Cittadini et al., 2010) [2].In this work, we take a different look at BGP updates, by quantifying the amount of prefix correlation in the BGP updates received by different routers in the Internet. We design a method to classify sets of BGP updates, called spikes, into either correlated or non-correlated, by comparing streams of BGP updates from multiple vantage points.Based on publicly available data, we show that a significant fraction of all BGP updates are correlated. Most of these correlated spikes contain updates for a few BGP prefixes only. When studying the topological scope of the correlated spikes, we find that they are relatively global given the limited AS hop distance between most ASs in the Internet, i.e., they propagate at least 2 or 3 AS hops away. Most BGP updates visible from publicly available vantage points are therefore related to small events that propagate across multiple AS hops in the Internet, while a limited fraction of the BGP updates appear in large bursts that stay mostly localised.Our results shed light on a fundamental while often misunderstood aspect of BGP, namely the correlation between BGP updates and how it impacts our beliefs about the share of local and global BGP events in the Internet. Our work differs from the literature in that we try as much as possible to explicitly account in our methodology for the visibility of BGP vantage points, and its implication on the actual claims that can be made from the data.

Sign what you really care about – Secure BGP AS-paths efficiently

The de facto inter-domain routing protocol, Border Gateway Protocol (BGP), plays a critical role in the reliability of the Internet routing system. However, the system may also be devastated by forged BGP routes that are generated by malicious attacks or mis-configurations. This security problem has attracted considerable attention, and although several solutions has been proposed, none of them have been widely deployed due to weaknesses such as high computational cost or potential security vulnerability. This paper proposes Fast Secure BGP (FS-BGP), an efficient mechanism that can secure AS-paths and prevent prefix hijacking by signing critical AS-path segments. We prove that FS-BGP achieves a similar level of security as S-BGP, but with much higher efficiency. Compared with S-BGP, the cost of signing and verification in FS-BGP can be reduced by orders of magnitude, as demonstrated in our experiments using BGP UPDATE data collected from real backbone routers. Indeed, the signing and verification can be accomplished as fast as the most bursty BGP UPDATE arrivals, which implies that FS-BGP will hardly delay the propagation of routing information.

Principal component analysis of BGP update streams

In this paper, we propose a novel methodology to identify border gateway protocol (BGP) updates associated with major events — affecting network reachability to multiple ASes — and separate them (statistically) from those attributable to minor events, which individually generate few updates, but collectively form the persistent background noise observed at BGP vantage points. Our methodology is based on principal component analysis, which enables us to transform and reduce the BGP updates into different AS clusters that are likely affected by distinct major events. We demonstrate the accuracy and effectiveness of our methodology through simulations and real BGP data.

Guest Editors' Introduction: Special Section on Autonomic Network Computing

IN the paper “Slicing Distributed Systems,” Gramoli et al. consider the problem of slicing—the partitioning of nodes into subsets using an one-dimensional attribute—in distributed systems. This problem arises in peer-to-peer networks and other popular distributed systems used in today’s large data centers. Slicing can help autonomic systems shift work dynamically among nodes and react dynamically to nodes dropping from the system or new nodes joining. The paper reviews existing approaches such as sorting and ranking and shows their problems in convergence, resulting in slow adaptation to changed conditions or inaccurate slice assignments in nonstatic networks. The authors introduce Sliver, a simple distributed slicing protocol that samples attribute values from the network and estimates the slice index from the sample. The theoretical results show that Sliver has provably rapid conversion, is robust under stress, and is simple to implement which they also show with simulation results of the new protocol. The paper “Cholla: A Framework for Composing and Coordinating Adaptations in Networked Systems” by Bridges et al. describes Cholla, a software architecture that separates the policy decisions of how and when adaptive components in networked systems react to their environment into separate centralized controllers that are constructed from composable rule sets. A major goal of this work is to develop a controller architecture that can be used for any collection of adaptive networking components, not a specific architecture that has to be implemented for each application-specific configuration or reimplemented each time that configuration changes. To achieve this, controllers are designed to be composable, with each adaptive component in the system contributing logic that together implements the overall functionality of the controller. This logic is implemented as rule sets that describe particular adaptation policies, and allow rule sets that implement linear, heuristic, and fuzzy control policies. Using composable control logic allows the controller to be specialized based not only on the set of adaptive components in the system, but also on the target network architecture and application requirements. This architecture consists of adaptable components, composable adaptation controllers, and a runtime system. In addition to describing the architecture of Cholla, this paper also presents a Linux-based prototype implementation of this architecture that controls and coordinates adaptation policy decisions inside network protocols and multimedia applications. An experimental evaluation of this prototype demonstrates that Cholla’s controller architecture enables component-based construction and customization of adaptation policies in networked systems, and that these policies can effectively control and coordinate adaptation. The paper “An Online Mechanism for BGP Instability Detection and Analysis” by Deshpande et al. proposes an online instability detection architecture for the border gateway protocol (BGP). BGP is one of the core building blocks of the Internet and is used to direct traffic between different subnetworks of the Internet, known as Autonomous Systems (ASs). The stability of BGP is critical to the stability of the Internet, and under stressful conditions such as worm attacks or router failures, BGP’s basic update protocol can result in severe route fluctuations and loss of connectivity for impacted networks for extended periods of time. The proposed architecture can be implemented by individual routers autonomously without the need for central control or centralized data. This allows widespread deployment without the need for modification of standards and also allows partial deployments without the need of large-scale cooperation among networks. The proposed system uses statistical techniques to detect instabilities using the time domain characteristics of BGP update message data and does not need any additional probing. The experimental evaluation using data collected from routers in Europe including data from several anomaly periods show that the system performs well various kinds of instabilities and across different topologies and policies. The paper “An Integrated Planning and Adaptive Resource Management Architecture for Distributed RealTime Embedded Systems” by Shankaran et al. looks at autonomicity issues in an open distributed embedded realtime environment. Such systems which may arise in context such as space control missions have fundamentally different characteristics than traditional embedded systems with controllable inputs. Autonomic operations require a close coordination between the resource planning needs of the IEEE TRANSACTIONS ON COMPUTERS, VOL. 58, NO. 11, NOVEMBER 2009 1441

An Online Mechanism for BGP Instability Detection and Analysis

The importance of border gateway protocol (BGP) as the primary interautonomous system (AS) routing protocol that maintains the connectivity of the Internet imposes stringent stability requirements on its route selection process. Accidental and malicious activities such as misconfigurations, failures, and worm attacks can induce severe BGP instabilities leading to data loss, extensive delays, and loss of connectivity. In this work, we propose an online instability detection architecture that can be implemented by individual routers. We use statistical pattern recognition techniques for detecting the instabilities, and the algorithm is evaluated using real Internet data for a diverse set of events including misconfiguration, node failures, and several worm attacks. The proposed scheme is based on adaptive segmentation of feature traces extracted from BGP update messages and exploiting the temporal and spatial correlations in the traces for robust detection of the instability events. Furthermore, we use route change information to pinpoint the culprit ASes where the instabilities have originated.

Time Window Mechanism to Improve BGP Routing Convergence

PDF HTML阅读 XML下载 导出引用 引用提醒 改善BGP路由收敛的时间窗口机制 DOI: 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: Supported by the National Natural Science Foundation of China under Grant No.60473082 (国家自然科学基金); the National Basic Research Program of China under Grant No.2003CB314801 (国家重点基础研究发展计划(973)) Time Window Mechanism to Improve BGP Routing Convergence Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:提出了一种时间窗口机制,能够基于路由抖动抑制中路由惩罚值的变化改善BGP(border gateway protocol)路由收敛.这种新机制把来自不同邻居的路由变化情况结合起来,利用BGP路由传播过程形成的路由相关性判断路由在网络中的稳定情况.时间窗口机制使BGP路由器能够更早地发现不稳定路由,优先将稳定路由选择为最优路由,终止路径搜索过程.模拟实验的结果表明,通过选择适当的参数,时间窗口机制能够大大缩短BGP路由收敛延时,减小收敛过程中的通信开销.而且,这种方法不需要在BGP的路由消息中增加额外的信息,因此容易在实际网络中逐步部署. Abstract:In this paper, a time window mechanism based on the penalty value of route flap damping is designed to improve routing convergence. This mechanism judges the route stability in the network from BGP (border gateway protocol) routes correlation by observing multiple routes received from different peers jointly. Then BGP speaker can find instable routes earlier and makes stable routes get the chance to be selected earlier in route selection, thus curtail path exploration. Simulation results prove that with proper parameters this method can reduce convergence delay and communication overhead obviously. Furthermore, without addition information in BGP Update message, time window mechanism is a practical method to be deployed in the Internet. 参考文献 相似文献 引证文献

Impact of Hot-Potato Routing Changes in IP Networks

Despite the architectural separation between intradomain and interdomain routing in the Internet, intradomain protocols do influence the path-selection process in the Border Gateway Protocol (BGP). When choosing between multiple equally-good BGP routes, a router selects the one with the closest egress point, based on the intradomain path cost. Under such hot-potato routing, an intradomain event can trigger BGP routing changes. To characterize the influence of hot-potato routing, we propose a technique for associating BGP routing changes with events visible in the intradomain protocol, and apply our algorithm to a tier-1 ISP backbone network. We show that (i) BGP updates can lag 60 seconds or more behind the intradomain event; (ii) the number of BGP path changes triggered by hot-potato routing has a nearly uniform distribution across destination prefixes; and (iii) the fraction of BGP messages triggered by intradomain changes varies significantly across time and router locations. We show that hot-potato routing changes lead to longer delays in forwarding-plane convergence, shifts in the flow of traffic to neighboring domains, extra externally-visible BGP update messages, and inaccuracies in Internet performance measurements.

Dynamics of hot-potato routing in IP networks

Despite the architectural separation between intradomain and interdomain routing in the Internet, intradomain protocols do influence the path-selection process in the Border Gateway Protocol (BGP). When choosing between multiple equally-good BGP routes, a router selects the one with the closest egress point, based on the intradomain path cost. Under such hot-potato routing, an intradomain event can trigger BGP routing changes. To characterize the influence of hot-potato routing, we conduct controlled experiments with a commercial router. Then, we propose a technique for associating BGP routing changes with events visible in the intradomain protocol, and apply our algorithm to AT&T's backbone network. We show that (i) hot-potato routing can be a significant source of BGP updates, (ii) BGP updates can lag 60 seconds or more behind the intradomain event, (iii) the number of BGP path changes triggered by hot-potato routing has a nearly uniform distribution across destination prefixes, and (iv) the fraction of BGP messages triggered by intradomain changes varies significantly across time and router locations. We show that hot-potato routing changes lead to longer delays in forwarding-plane convergence, shifts in the flow of traffic to neighboring domains, extra externally-visible BGP update messages, and inaccuracies in Internet performance measurements.