# RPKI Defense Capability Simulation Method Based on Container Virtualization
## 6 Experimental Verification and Analysis
### Large-Scale Network Simulation Scenario Testing and Defense Results Analysis  
The RPKI defense results in a large-scale BGP simulation network reflecting the authenticity of the simulation method, which is also a crucial indicator for distinguishing various simulation methods and holds significant enlightening significance for the deployment of the RPKI on the internet. To validate that our simulation method can support the  
Figure 5: Integrated virtual–real network scene topology diagram. requirements of creating large-scale BGP networks, it is necessary to establish simulation experimental scenarios for large-scale target networks. The simulation scenario involves a total of 905 virtual nodes, including 452 virtual routing nodes and 453 RPKI simulation nodes, distributed across two computing nodes. To ensure the high fidelity of the simulation test scenario, we extracted AS resources (IPv4 address blocks, IPv6 address blocks, and AS numbers) owned by a specific country and the connection relationships between the ASes on the basis of CAIDA AS Rank [32] and AS Relationships [33] topology datasets. Each AS was abstracted as a virtual routing node, allowing us to construct a complex simulation network topology on OpenStack computing nodes. Benefiting from Neutron's isolated network, the simulation network does not impact the real network and enables cross-host communication for the virtual nodes through the network node. This verifies that, given sufficient physical server resources, deploying hundreds of virtual nodes on various physical hosts in a distributed manner can be achieved to compose a larger-scale simulation test scenario. The topology of the simulation network is illustrated in Figure 6. The cloud symbol represents a network we created, with the colors primarily used for visual distinction, while the host symbol represents a routing node or a RP node. The lines indicate that the nodes are directly connected through a specific network. Figure 6: Large-scale BGP simulation network experimental scenario. On the basis of the target network topology information, the experimental results of the prefix hijacking and subprefix hijacking attacks conducted according to the simulation test designed in this paper are shown in Figure 7. The results measure the security protection obtained by the BGP simulation network using an ROV from both the data and control planes and demonstrate the additional benefits of deploying the RPKI for nondeployed ASes. Figure 7a shows the relationship between the overall hijacking rate at the data plane and the RPKI deployment rate. For ordinary prefix hijacking, the best path selection in the BGP mainly depends on the length of the AS path. Therefore, in the absence of RPKI deployment (RPKI deployment rate = 0), some ASes have a higher priority for legitimate prefix holders and are not affected by malicious attacks. In contrast, for subprefix hijacking, on the basis of the longest prefix forwarding rule, all the routing nodes are maliciously hijacked in the absence of any security mechanisms. The experimental results indicate that the RPKI has a better defense against prefix hijacking attacks when the RPKI deployment rate is relatively low. As the deployment rate increases, both in the control and data planes, the simulation network shows a significant improvement in defense against malicious attacks. However, as shown in Figure 7c, the RPKI also has certain ancillary benefits for other nondeployed ASes. Nevertheless, the improvement in security for nondeployed ASes is limited, and there is no significant difference in the defense against different types of attacks. The above experimental results indicate that the RPKI can achieve a high level of defense even at relatively low deployment rates. As the deployment rate increases, the improvement in defense efficiency gradually becomes less pronounced. However, from a network security perspective, deploying the RPKI to counteract hijacking attacks is still recommended.