Large Route Leaks

Large route leaks (LRL) are a specific type of prefix hijacking, in which an unauthorized network hijacks prefixes owned by multiple different networks. We design and implement a detection system which is able to detect LRL events at real time and without requiring authoritative prefix ownership information. By correlating individual suspicious routing announcements along the time dimension and comparing with a network's past behavior, we are able to identify a network's abnormal behavior of offending multiple other networks at the same time. 

Applying the detection algorithm to BGP updates collected by RouteViews Oregon monitor from 2003 through 2009, we identify five to twenty large route leaks every year. They typically hijack prefixes owned by a few tens of other networks, last from a few minutes to a few hours, and pollute routes at most vantage points of the data collector. In particular there are nine events detected in 2009 and six in 2008, none of which was mentioned on operator mailing lists such as NANOG, but all are confirmed through our communication with operators of affected networks.

The system can take real-time BGP data feed and conduct the detection quickly, enabling automated response to these attacks without requiring authoritative prefix ownership information or human intervention. This is important for all networks to protect their data traffic before the attack can be resolved.

The following table lists the large route leak events detected from 2003 through 08/12/2010 using data from RouteViews Oregon collector. 

2010:

2009:

2008:

2007:

2006:

2005:

2004:

2003: