# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 3 BGP Anomalies and Attacks
### Prefix Attacks  
Previous research has shown that up to 72% of domains are vulnerable to the most basic of BGP subprefix hijacks and up to 70% are vulnerable to same-prefix attacks [41; 42]. Research has also shown the ease with which bogus certificates can be obtained from the top five Certificate Authorities (CAs), with all being susceptible to standard BGP hijack attacks. Following these validated attacks, some CAs began implementing mitigation, though highly targeted surgical BGP attacks using stealth remain a threat [41; 43].  
Traditional prefix hijacks involve the unauthorized announcement of IP prefixes, effectively attracting traffic intended for the legitimate prefix owner towards a malicious AS. The simplicity yet effectiveness of traditional prefix hijacks have been demonstrated in numerous instances, causing widespread disruption and posing significant challenges in their mitigation [6]. Prefix hijacking involves an attacker AS (ASA), such as the one in Figure 3), intentionally announcing IP prefixes that it does not own, thereby misleading traffic through unauthorized paths. As depicted in Figure 3, ASA falsely claims ownership of the IP prefix 172.22.0.0/16, which actually belongs to ASV (the victim).  
This unauthorized announcement is strategically made to ASX, ASY, and particularly ASZ, positioning ASA as a seemingly legitimate intermediary for traffic destined for ASV. By doing so, ASA attempts to force ASZ, a critical juncture in the routing path, to adopt these fake routes, effectively diverting the traffic through ASA. This diversion disrupts the intended routing path and opens up avenues for additional malicious activity, as ASA gains undue control over the traffic flow meant for ASV. The impact of such attacks is multifold, leading to potential traffic interception, data theft, and denial of service, thereby posing a significant threat to the confidentiality, integrity, and availability of data traversing the Internet.  
In addition, prepended prefix hijacks introduce an additional layer of complexity, involving the manipulation of an AS path prepending to influence BGP route selection. By artificially inflating the AS path length, attackers can subtly influence traffic flows, redirecting them through malicious or unintended paths, thereby enabling the analysis,interception, or even manipulation of the traffic. Real-world instances of prepended prefix hijacks have highlighted the challenges in detecting and mitigating them, given their subtle and often inconspicuous nature, which may not immediately disrupt traffic flows or raise alarms.  
Both traditional and prepended prefix hijacks highlight a spectrum of challenges and considerations in their detection and mitigation. While both hijack types exploit the BGP's inherent trust and lack of authentication, their tactics, stealth, and impact can vary significantly, thereby necessitating a nuanced approach to their mitigation. The development and implementation of countermeasures, such as path validation, prefix filtering, and cryptographic validation mechanisms, have been explored to various degrees, yet the decentralized and trust-based architecture of the BGP continues to pose persistent challenges in ensuring robust, secure inter-domain routing. In summary, prefix hijacks, in their various forms, underscore the imperative for enhanced security mechanisms within the BGP.