Patent ID: 7823202
Filing Date: 2010-10-26
Classification: H04L

Abstract:
1. A method for generating a prefix hijacking alert in a network, wherein a plurality of network traffic flows are routed based at least on a plurality of prefix announcements from one or more Border Gateway Protocol (BGP) router, the method comprising: identifying, using a computer, an anomalous prefix from the plurality of prefix announcements; identifying, using the computer, a network traffic anomaly from the plurality of network traffic flows; and correlating, using the computer, the anomalous prefix and the network traffic anomaly to generate the prefix hijacking alert, wherein each of the plurality of prefix announcements comprises an announcement time stamp, a prefix, an origin autonomous system (AS), and an association corresponding to the prefix and the origin AS, and wherein identifying the anomalous prefix comprises: wherein establishing the valid association set comprises: wherein each of the plurality of network traffic flows comprises at least one selected from a group consisting of a traffic flow time stamp, a source IP-address, a destination IP-address, a flow size, a network protocol identifier, and a destination port number, the method further comprising: