Argus: a hijacking alarm system

Yang Xiang xiangy08 at csnet1.cs.tsinghua.edu.cn
Fri Jan 20 09:47:21 UTC 2012


Hi,

I build a system ‘Argus’ to real-timely alert prefix hijackings.
Argus monitors the Internet and discovers anomaly BGP updates which caused
by prefix hijacking.
When Argus discovers a potential prefix hijacking, it will advertise it in
a very short time,
both in our website (http://argus.csnet1.cs.tsinghua.edu.cn) and the
mailing list (argus at csnet1.cs.tsinghua.edu.cn).

Argus has been running in the Internet for more than eight months,
it usually can discover potential prefix hijackings in ten seconds after
the first anomaly BGP update announced.
Several hijacking alarms have been confirmed by network operators.
For example: http://argus.csnet1.cs.tsinghua.edu.cn/fingerprints/61544/ has
been confirmed by the network operators of AS23910 and AS4538,
it was a prefix hijacking caused by a mis-configuration of route filter.

If you are interest in BGP security, welcome to visit our website and
subscribe the mailing list.
If you are interest in the system itself, you can find our paper which
published in ICNP 2011 (FIST workshop)
http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=6089080.

Hope Argus will be useful for you.
_________________________________
Yang Xiang . about.me/xiangyang
Ph.D candidate. Tsinghua University
Argus: argus.csnet1.cs.tsinghua.edu.cn



More information about the NANOG mailing list