Internet Routing Infrastructure Research Articles

Improvisation of Node Mobility Using Cluster Routing-based Group Adaptive in MANET

In today's Internet routing infrastructure, designers have addressed scaling concerns in routing constrained multiobjective optimization problems examining latency and mobility concerns as a secondary constrain. In tactical Mobile Ad-hoc Network (MANET), hubs can function based on the work plan in various social affairs and the internally connected hubs are almost having the related moving standards where the topology between one and the other are tightly coupled in steady support by considering the touchstone of hubs such as a self-sorted out, self-mending and self-administration. Clustering in the routing process is one of the key aspects to increase MANET performance by coordinating the pathways using multiple criteria and analytics. We present a Group Adaptive Hybrid Routing Algorithm (GAHRA) for gathering portability, which pursues table-driven directing methodology in stable accumulations and on-request steering strategy for versatile situations. Based on this aspect, the research demonstrates an adjustable framework for commuting between the table-driven approach and the on-request approach, with the objectives of enhancing the output of MANET routing computation in each hub. Simulation analysis and replication results reveal that the proposed method is promising than a single well-known existing routing approach and is well-suited for sensitive MANET applications.

Norm conflict in the governance of transnational and distributed infrastructures: the case of Internet routing

ABSTRACT This paper explores how a deeply embedded norm can be used to exert power and control in the governance of distributed infrastructures, such as the Internet. Through the lens of norm conflict, I analyse a case of resistance against the introduction of norms in the transnational governance of Internet routing. In a mixed-methods case study, I examine through an experiment how a community of network operators resists the introduction of data protection and human rights norms in the Internet routing infrastructure. To provide a possible explanation as to how a prevalent and deeply embedded norm enables the resistance to the introduction of new norms, I develop the notion of ‘infrastructural norms’. This concept could help explain why Internet infrastructure governance thus far has largely defied national and international democratic norms. The understanding of how norms are used in infrastructure governance contributes to the study of power in large technical systems.

Multifractal detrended fluctuation analysis based detection for SYN flooding attack

The TCP SYN flooding (half-open connection) attack is a type of DDoS attack, which denies the services by consuming the server resources. This attack prevents legitimate users from using their desired service. The SYN flooding attack exploits the normal TCP three-way handshake by sending stream of SYN packets to the server with spoofed IP addresses. The detection of this attack is hard since the internet routing infrastructure cannot differentiate between legitimate and spoofed SYN packets. In this paper we present a new detection method for the SYN flooding attack based on Multifractal Detrended Fluctuation Analysis (MFDFA) in addition to an adaptive threshold, thus we can detect the abnormal behavior in the TCP protocol time series.

Detection of Distributed Denial of Service Flooding Attack Using Odds Ratio

Computer networks are vulnerable to many types of attacks while the Distributed Denial of Service attack (DDoS) serves as one of the top concerns for security professionals. The DDoS flooding attack denies the services by consuming the server resources to prevent the legitimate users from using their desired services. The hardness of detecting this attack lies in sending a stream of packets to the server with spoofed IP addresses, so that the internet routing infrastructure cannot distinguish the spoofed packets. Based on the odds ratio (OR) statistical measurement, in this work we propose a new detection method for the DDoS flooding attacks. By exploring the odds ratio to determine the risk factor of any incoming traffic to the server, the legitimate and attack traffic packets can be easily differentiated. Experimental results demonstrate the efficiency of the presented detection method in terms of its detection probability and detection time.

Understanding the latency to visit websites in China: An infrastructure perspective

As the Internet becomes more and more widely used in our daily life, its latency has been regarded as a truly critical issue for various Internet applications. Researchers propose an ambitious goal to pursue “Speed-of-Light Internet. However, there is a large gap between the reality and the goal, and a lot of infrastructure inefficiency caused by simple issues has been observed in some developing or rural regions. In this article, we conduct a measurement study on the latency to visit more than 638 K websites in China from five well-connected vantage points, and examine the unnecessary latency caused by the inefficiency of DNS infrastructure and Internet routing infrastructure in China. We find that DNS resolution is the most significant contributor to the overall latency and investigate several important factors that affect DNS latency, i.e., caching, CNAME and delegation. In terms of Internet routing infrastructure in China, we observe that 1) the inter-domain routing in China relies too heavily on the three oldest IXPs while the newly deployed IXPs are under-used significantly, which results in unnecessary routing circuitousness; and 2) most congested links are the links connecting cities with IXPs and these links should be upgraded or utilized with more efficient traffic engineering systems. Furthermore, in order to compute circuitousness ratios and locate congested links, we also propose a method to geolocate IP addresses in China more accurately and we make the geolocation results for IP addresses under the study of this work publicly accessible to facilitate future research efforts.

An Ontological Graph Identification Method for Improving Localization of IP Prefix Hijacking in Network Systems

IP prefix hijacking continues to be a pervasive cyber security threat to the core internet routing infrastructure. The data security of multiple cloud-based services is also susceptible to these threats, due to the high dependency on traditional routing protocols. Although a number of hijacking detection techniques have been recently proposed, no existing system has effectively addressed the problem of detecting malicious transit Autonomous System (AS) services in any detected hijacking occurrences. The ability to locate and isolate malicious services is critical for conducting a necessary mitigation strategy at an early stage, to minimise the impact of the attack, to restore cloud services quickly. In this paper, we propose an effective real-time processing method, so-called Ontological Graph Identification (OGI), for detecting IP prefix hijacking of nodes and suspicious transit nodes caused by the hijacked nodes through ASs. The proposed method is evaluated using the two public datasets of RIPE RIS and RouteView. Experimental results revealed improved performance for the detection of malicious transit nodes compared with peer techniques. It is, therefore, shown that the proposed method has utility in automating the process of investigating nodes with suspicious activities in real network systems.

Protecting internet infrastructure against link flooding attacks: A techno-economic perspective

As an emerging threat, link flooding attacks (LFAs) target and congest core links that constitute Internet routing infrastructure, hence posing a growing threat to networks worldwide. Mitigating and defeating LFAs is particularly challenging for two reasons. First, arising from the end-to-end communication from bots to public servers (e.g., Web servers), the attack traffic flows could be indistinguishable from legitimate ones, and even unobservable to the victim network surrounded by the target links. Therefore, typical flow-filtering countermeasures deployed at the network perimeter become invalid when handling LFAs. Second, the target link and the victim network belong to an autonomous system (AS) different from the source ASs where the attack traffic flows originate. These source ASs, however, have no idea the target link is under attack, whereas they are in charge of routing decisions and thus capable of mitigating LFAs by rerouting the attack traffic flows to bypass the target link. Therefore, inter-AS cooperation is indispensable to defeat LFAs. Unfortunately, the source ASs lack incentives to cooperate because the collateral damage of LFAs to them may be negligible, making it challenging to eradicate LFAs. In this paper, we make the first effort to cope with LFAs from a techno-economic perspective, for accelerating ISPs’ cooperation in defending against LFAs. We propose two novel mechanisms to mitigate LFAs by stimulating the inter-AS cooperation via incentive design and Nash bargaining. Experiments using Internet AS relationship data demonstrate the feasibility and effectiveness of our mechanisms.

A study of IP prefix hijacking in cloud computing networks

ABSTRACTIP prefix hijacking remains a serious security threat to the traditional services in the Internet. It also harms the confidentiality and integrity of user data in Internet‐enabled cloud services because of its great dependence on Internet routing infrastructure. In addition, collaborations between networks in the cloud environment, especially in cross‐domain deployment, bring about new types of prefix hijacking attack, which may cause greater impact due to side‐effect of the cooperation of victim and infected autonomous systems. It is important to understand what impact a prefix hijacking attack can cause and how the number and locations of participants can affect the attacking results. In this paper, we model this problem as an attack planning task and solve it by applying a genetic algorithm. By analyzing the best solution to the problem, we find that the type of victims plays a more important role in IP prefix hijacking than that of attackers. Attackers can gain great impact even when the prefixes of a small number of victims are hijacked. For attack planning, the degree of an autonomous system is a major criterion to be considered. These findings are useful for securing cloud computing networks by preventing and eliminating IP prefix hijacking attacks. Copyright © 2013 John Wiley & Sons, Ltd.

Keychain-Based Signatures for Securing BGP

As a major component of Internet routing infrastructure, the Border Gateway Protocol (BGP) is vulnerable to malicious attacks. While Secure BGP (S-BGP) provides a comprehensive framework to secure BGP, its high computational cost and low incremental deployment benefits seriously impede its wide usage in practice. Using a lightweight symmetric signature scheme, SPV is much faster than S-BGP. However, the speed boost comes at the price of prohibitively large signatures. Aggregated path authentication reduces the overhead of securing BGP in terms of both time and space, but the speed improvement is still limited by public key computation. In this paper, we propose a keychain-based signature scheme called KC-x. It has low CPU and memory overheads and provides strong incentive for incremental deployment on the Internet. As a generic framework, KC-x has the flexibility of using different signature algorithms, which can even co-exist in a hybrid deployment. We investigate two implementations of KC-x: KC-RSA based on RSA and KC-MT based on Merkle hash tree. Using real BGP workloads, our experimental results show that KC-RSA is as efficient as SAS-V (the most efficient software approach for aggregated path authentication), and KC-MT is even three times faster than SPV with 40% smaller signatures. Through the hybrid deployment of KC-MT and KC-RSA, KC-x can achieve both small signature and high processing rate for BGP speakers.

A Survey of BGP Security Issues and Solutions

As the Internet's de facto interdomain routing protocol, the Border Gateway Protocol (BGP) is the glue that holds the disparate parts of the Internet together. A major limitation of BGP is its failure to adequately address security. Recent high-profile outages and security analyses clearly indicate that the Internet routing infrastructure is highly vulnerable. Moreover, the design of BGP and the ubiquity of its deployment have frustrated past efforts at securing interdomain routing. This paper considers the current vulnerabilities of the interdomain routing system and surveys both research and standardization efforts relating to BGP security. We explore the limitations and advantages of proposed security extensions to BGP, and explain why no solution has yet struck an adequate balance between comprehensive security and deployment cost.

Fighting physics

The laws of physics and the Internet's routing infrastructure affect performance in a big way.

Securing the Internet's Routing Infrastructure

Experts have been concerned about the security of the Internet's routing infrastructure, which was designed many years ago. Now, organizations are developing proposals to secure the infrastructure.

BGP routing dynamics revisited

Understanding BGP routing dynamics is critical to the solid growth and maintenance of the Internet routing infrastructure. However, while the most extensive study on BGP dynamics is nearly a decade old, many factors that could affect BGP dynamics have changed considerably. We revisit this important topic in this paper, focusing on not only comparing with the previous results, but also issues not well explored before. We have found that, compared to almost a decade ago, although certain characteristics remain unchanged (such as some temporal properties), BGP dynamics are now 'busier,' and more importantly, now have much less pathological behavior and are 'healthier'; for example, forwarding dynamics are now not only dominant, but also more consistent across different days. Contributions to BGP dynamics by different BGP peers-which are not proportional to the size of a peer's AS-are also more stable, and dynamics due to policy changes or duplicate announcements are usually from specific peers

Understanding the network-level behavior of spammers

This paper studies the network-level behavior of spammers, including: IP address ranges that send the most spam, common spamming modes (e.g., BGP route hijacking, bots), how persistent across time each spamming host is, and characteristics of spamming botnets. We try to answer these questions by analyzing a 17-month trace of over 10 million spam messages collected at an Internet "spam sinkhole", and by correlating this data with the results of IP-based blacklist lookups, passive TCP fingerprinting information, routing information, and botnet "command and control" traces.We find that most spam is being sent from a few regions of IP address space, and that spammers appear to be using transient "bots" that send only a few pieces of email over very short periods of time. Finally, a small, yet non-negligible, amount of spam is received from IP addresses that correspond to short-lived BGP routes, typically for hijacked prefixes. These trends suggest that developing algorithms to identify botnet membership, filtering email messages based on network-leve l properties (which are less variable than email content), and improving the security of the Internet routing infrastructure, may prove to be extremely effective for combating spam.

A framework for resilient internet routing protocols

At a fundamental level, all Internet-based applications rely on a dependable packet delivery service provided by the Internet routing infrastructure. However, the Internet is a large-scale complex loosely coupled distributed system made of many imperfect components. Faults of varying-scale and severity occur from time to time. In this paper we survey the research efforts over the years aimed at enhancing the dependability of the routing infrastructure. To provide a comprehensive overview of the various efforts, we first introduce a threat model based on known threats, then sketch out a defense framework, and put each of the existing efforts at appropriate places in the framework based on the faults and attacks against which it can defend. Our analysis shows that although individual defense mechanisms may effectively guard against specific faults, no single fence can counter all faults. Thus, a resilient Internet routing infrastructure calls for integrating techniques from cryptographic protection mechanisms, statistical anomaly detection, protocol syntax checking, and protocol semantics checking to build a multifence defense system.

Securing the Internet routing infrastructure

The unprecedented growth of the Internet over the last years, and the expectation of an even faster increase in the numbers of users and networked systems, resulted in the Internet assuming its position as a mass communication medium. At the same time, the emergence of an increasingly large number of application areas and the evolution of the networking technology suggest that in the near future the Internet may become the single integrated communication infrastructure. However, as the dependence on the networking infrastructure grows, its security becomes a major concern, in light of the increased attempt to compromise the infrastructure. In particular, the routing operation is a highly visible target that must be shielded against a wide range of attacks. The injection of false routing information can easily degrade network performance, or even cause denial of service for a large number of hosts and networks over a long period of time. Different approaches have been proposed to secure the routing protocols, with a variety of countermeasures, which, nonetheless, have not eradicated the vulnerability of the routing infrastructure. In this article, we survey the up-to-date secure routing schemes. that appeared over the last few years. Our critical point of view and thorough review of the literature are an attempt to identify directions for future research on an indeed difficult and still largely open problem.

Secure Border Gateway Protocol (S-BGP)

The Border Gateway Protocol (BGP), which is used to distribute routing information between autonomous systems (ASes), is a critical component of the Internet's routing infrastructure. It is highly vulnerable to a variety of malicious attacks, due to the lack of a secure means of verifying the authenticity and legitimacy of BGP control traffic. This paper describes a secure, scalable, deployable architecture (S-BGP) for an authorization and authentication system that addresses most of the security problems associated with BGP. The paper discusses the vulnerabilities and security requirements associated with BGP, describes the S-BGP countermeasures, and explains how they address these vulnerabilities and requirements. In addition, this paper provides a comparison of this architecture to other approaches that have been proposed, analyzes the performance implications of the proposed countermeasures, and addresses operational issues.