# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 3 BGP Anomalies and Attacks
### AS Path Forgery  
AS path forgery strategically manipulates the AS path attribute in BGP announcements to mislead routers and divert Internet traffic through unintended paths. This attack category, while potentially not as overtly disruptive as prefix or subprefix hijacking, carries its own set of unique challenges and threats to the stability and security of inter-domain routing.  
In a typical AS path forgery attack, the malicious actor announces IP prefixes with a manipulated AS path, altering the sequence of ASs that the announcement has traversed. This could involve injecting additional AS numbers, reordering existing ASs, or even spoofing the origin AS, thereby presenting a falsified path to receiving routers. The receiving routers, trusting the received BGP announcement, update their routing tables accordingly, inadvertently directing traffic through the attacker's AS, or another AS of the attacker's choosing.  
In the first scenario, depicted in the upper portion of Figure 5, we can observe the one-hop prefix hijack, a sophisticated instance of AS path forgery. Here, ASA (the attacker) crafts a BGP announcement for the IP prefix 172.22.0.0/16, incorporating a fabricated AS path that falsely indicates a direct connection to ASV (the victim). This manipulated announcement misleads ASX, ASY, and ASZ into routing traffic intended for ASV through ASA under the guise of offering a more direct or efficient path (ASA, ASV). Such a maneuver not only disrupts the intended flow of data but also exposes it to unauthorized interception or manipulation by ASA, thereby compromising the security and integrity of data directed towards ASV.  
The second scenario, illustrated in the lower portion of Figure 5, describes a one-hop subprefix hijack. In this refined attack, ASA announces the route of a more specific IP prefix, 172.22.0.0/20, carving out a segment from ASV's broader 172.22.0.0/16 network. The announcement includes a forged AS path that suggests a non-existent direct link to ASV, misleading other ASs to route a portion of the traffic through ASA. This strategy  
Figure 4: Subprefix hijack.  
exploits the BGP's longest prefix match rule to siphon off traffic meant for ASV, allowing ASA to intercept, analyze, or manipulate the data in transit.  
AS path poisoning is another example within the AS path forgery category of attack that involves the intentional insertion of AS numbers into the AS path attribute of a BGP announcement to influence the propagation of the route and potentially prevent certain ASs from receiving it. By \"poisoning\" the AS path with specific AS numbers, the attacker can manipulate the BGP's loop-prevention mechanism, which discards routes containing its own AS number in their AS path, thereby controlling the propagation of the malicious BGP announcement. This can be utilized to perform targeted attacks, create routing asymmetry, or to avoid detection by specific ASs or monitoring systems.  
Some researchers have further defined this category of attacks into Type-1 to Type-5 attacks:  
* Type-1 Attack: The attacker (ASA) strictly claims to be a neighbor of the victim (ASV) by announcing a forged AS path A, V. This is a direct assertion of false adjacency and is a clear example of AS path forgery.
* Type-2 to Type-5 Attacks: These involve extending the forged AS path, claiming to be progressively further from the ASV in terms of AS hops. The longer the forged path, the stealthier, but potentially less impactful, the attack becomes in terms of traffic redirection.  
While the prepended (sub)prefix attacks described in previous sections influence route selection, AS path forgery directly deceives routers about the path's legitimacy or origin. AS path poisoning intentionally makes a route unattractive or unacceptable to specific ASs. In summary, they define the forging of AS path in the BGP announcement to claim different levels of proximity to the victim.