# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 6 Attacks that Require Advanced Detection  
This section evaluates various BGP attacks. It categorizes attacks into groups such as prefix hijacking, subprefix hijacking, AS path forgery, AS path poisoning, interception attacks, and others, while assessing the complexity and need for group-level AS and MVP analyses. This section discusses how certain attacks, due to their distributed and stealthy nature, require advanced detection techniques that leverage multiple viewpoints across the Internet. A detailed evaluation table is provided to classify these attacks based on their potential to benefit from advanced detection methods, including whether they involve complex interactions, stealthiness, or evasion tactics. The analysis emphasizes the need for sophisticated detection approaches capable of understanding grouped AS dynamics for early the identification of such advanced attacks. We evaluate all known categories of BGP attacks based on previous research [6], with some recent advanced attacks included [15]. Focus is on the attack characteristics that might benefit from an advanced detection technique, leveraging group-level AS and multiple-vantage-point analysis and detection. The following is a summary of the inclusion and exclusion criteria used to evaluate the suitability of BGP attacks for advanced anomaly detection techniques that leverage group-level AS analyses and MVP observations. * **Inclusion Criteria:*
* MVP Detection: Attacks detectable earlier through the correlation of data from multiple network viewpoints, revealing inconsistencies in BGP announcements (e.g., attack surfaces and temporal elements). * Collaborative or Distributed Nature: Attacks involving collusion between ASs, requiring group-level analysis to detect coordinated malicious activities. * Complex AS Interactions: Attacks involving intricate routing dynamics across multiple ASs that require an understanding of AS relationships for detection. * Sophisticated BGP Manipulation: Advanced attacks where the manipulation of routing information is subtle and requires a multi-AS viewpoint analysis to detect. * Stealthy/Evasive Techniques: Attacks designed to evade conventional monitoring, including those that selectively announce or alter AS path attributes to bypass public route collectors. * **Exclusion Criteria:*
* _Simple Attacks_: Direct attacks such as basic prefix hijacking, which are easily detectable without sophisticated multi-point analysis. * _Non-BGP Attacks_: Attacks relying on vulnerabilities outside the BGP, such as non-protocol-layer attacks. * _Non-Strategic Impact_: Attacks that do not influence BGP routing decisions strategically or involve complex AS-level interactions. Table 1 details the criteria that were used to evaluate advanced BGP attacks. In Table 2, each of the BGP attacks is evaluated based on these criteria, with an assessment made of their comparative attack complexity. \begin{table}
\begin{tabular}{l l} \hline \hline
**Criteria Type** & **Description** \\ \hline \multirow{3}{*}{Inclusion 1} & Attacks that could be detected earlier by leveraging data from multiple vantage points across the Internet, \\  & providing a more comprehensive view of the global routing table than single-point observations. This includes \\ \cline{1-1}  & attacks where discrepancies in BGP announcements across different locations could indicate an anomaly, requiring \\ \cline{1-1}  & the correlation of data from multiple sources for early detection (attack surface and temporal elements). \\ \hline \multirow{2}{*}{Inclusion 2} & Attacks that involve collusion between ASs or are distributed in nature, benefiting from a group-level analysis to uncover coordinated malicious activities (collaborative or distributed nature). \\ \cline{1-1}  & attacks that involve collusion between ASs or are distributed in nature, benefiting from a group-level analysis to uncover coordinated malicious activities (collaborative or distributed nature). \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Inclusion and exclusion criteria for evaluating BGP attacks.