TWC: TTP Option: Small: Collaborative: Detecting and Characterizing Internet Traffic Interception Based on BGP Hijacking

TWC：TTP 选项：小：协作：基于 BGP 劫持检测和表征互联网流量拦截

• 批准号: 1422566
• 负责人: Phillipa Gill
• 金额: $ 17.29万
• 依托单位: SUNY at Stony Brook
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-08-01 至 2017-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1422566&HistoricalAwards=false
• 关键词: TWC; TTP; Option; Small; Collaborative

Recent reports have highlighted incidents of massive Internet traffic interception executed by re-routing Border Gateway Protocol (BGP) paths across the globe (affecting banks, governments, entire network service providers, etc.). The potential impact of these attacks can range from massive eavesdropping to identity-spoofing or selective content modification. In addition, executing such attacks does not require access or proximity to the affected links and networks, posing increasing risks to national security. Worse yet, the impact of traffic interception on the Internet is practically unknown, with even large-scale and long-lasting events apparently going unnoticed by the victims. Because of the complex dynamics and number of different actors involved on a global scale, devising effective methodologies for the detection and characterization of traffic interception events requires empirical and timely data (e.g., acquired while the event is still ongoing). Such data must be a combination of passive BGP measurements and active measurements (such as Traceroute), since the mechanism triggering the attack operates on the inter-domain routing control plane, but the actual impact is only verifiable in the data plane. By leveraging our measurement and data processing infrastructure, this project aims to: (i) investigate, develop, and experimentally evaluate novel methodologies to automatically detect traffic interception events and to characterize their extent, frequency, and impact; (ii) extend the research team's measurement infrastructure to detect in near-real-time and report episodes of traffic interception based on BGP hijacking; and (iii) document such events, providing datasets to researchers and summary statistics and reports to operators, emergency response teams, law enforcement agencies, and policy makers.

最近的报告强调了通过重新布置全球边境网关协议（BGP）路径（影响银行，政府，整个网络服务提供商等）进行大规模互联网流量截距的事件。这些攻击的潜在影响范围从大量窃听到身份散布或选择性内容修改。此外，执行此类攻击不需要访问或接近受影响的链接和网络，从而增加了对国家安全的风险。更糟糕的是，交通拦截对互联网的影响实际上是未知的，甚至受害者显然没有注意到大规模和持久的事件。由于在全球范围内涉及的不同参与者的复杂动态和数量，因此设计有效的方法来检测和表征交通截距事件需要经验和及时的数据（例如，在事件仍在进行时获得）。这样的数据必须是被动BGP测量和主动测量值的组合（例如Traceroute），因为触发攻击的机制在域间路由控制平面上运行，但是实际影响仅在数据平面中可验证。通过利用我们的测量和数据处理基础架构，该项目的目的是：（i）调查，开发和实验评估新型方法，以自动检测交通截距事件并表征其程度，频率和影响； （ii）扩展了研究团队的测量基础架构以在近实时检测并报告基于BGP劫持的交通拦截事件； （iii）记录此类事件，向研究人员提供数据集，并向运营商，应急小组，执法机构和政策制定者提供汇总统计数据和报告。