Patent ID: 9654504
Date: 2017-05-16
CPC Classifications: H04L

Claim:
1. A method comprising: identifying a set of inactive addresses, each inactive address of the set of inactive addresses having routing information comprising border gateway protocol information and registration information, wherein the set of inactive addresses is identified based on each inactive address of the set of inactive addresses appearing in a route advertisement message and subsequently not appearing in a route path for a predetermined period of time; monitoring border gateway protocol information and registration information for each inactive address of the set of inactive addresses; identifying a suspicious activity associated with at least one inactive address of the set of inactive addresses based on monitoring of corresponding gateway protocol information and registration information, wherein the suspicious activity comprises a mismatch between an actual routing configuration and an expected routing configuration defined in the registration information; upon identifying the suspicious activity associated with the at least one inactive address, determining an initial suspicion score for the at least one inactive address; monitoring the at least one inactive address for additional activity, wherein the additional activity is a second suspicious activity or a malicious activity; when the additional activity is detected, updating the suspicion score for the at least one inactive address based on the additional activity, wherein updating the suspicion score for the at least one inactive address comprises: categorizing the at least one inactive address as a potentially hijacked address if the suspicion score exceeds a threshold.