# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 3 BGP Anomalies and Attacks
### Monitor-Evasive Attacks  
Increasingly smarter attacks have been designed to avoid public BGP collector and monitor infrastructures; these are effectively deployed as'monitor-aware' attacks, as has been described in [15]. BGP policies or communities can also be manipulated to assist in advanced attacks (e.g., MED modification, Local Preference manipulation, or BGP community tagging and engineering). These attacks leverage knowledge of the global BGP policy landscape and specific vulnerabilities in the route selection process to ensure that the malicious path, while passing through an AS, does not trigger any alarms or become preferable to the paths monitored by public collector infrastructure [15]. Thus, monitor-evasive attacks are those those that can evade public route collection infrastructure by limiting the propagation of their attack, strategically identifying ASs in the announced path, increasing the announced AS path length, and exporting the attack to the chosen network victims [15]. In other words, advanced BGP attacks can avoid detection by public Internet infrastructure in two ways; either the peer has no visibility of the attack, as it did not propagate via any neighboring ASs, or the attack has propagated to the peer but the hijack was not stored in the Loc-RIB, therefore the victim's path was propagated to the collector and no anomaly was detected. For example, consider the model of a BGP speaker that is illustrated in Figure 1; the hijacked announcement will not be stored or propagated to the collector (Figure 8). Advanced attacks can partition Internet regions into ASs that will preference the attacker's AS path and those that will preference a victim's AS path for the purposes of  
Figure 8: Attack was neither stored nor detected. evading public route collection infrastructure [15]. The partitioning of ASs into groups for evasive BGP attacks means that any detection scheme must capture high-dimensional group-level interactions, dynamics, and information. There are very few studies that have investigated this type of attack, but a rigorous description and analysis of the taxonomy and function of monitor-evasive attacks can be found in the literature [15; 46]. The attacker ensures that its bogus announcements bypass the public BGP route collectors. Studies show that current collection strategies do not provide comprehensive visibility of the global routing system and are hence vulnerable to these attacks [15; 47]. All existing BGP anomaly detection schemes are designed from single observables and almost entirely rely on public collector infrastructure. Monitor-evasive attacks have been designed to avoid public collector infrastructure and exploit single-observable approaches, as they provide limited, narrow-view detection visibility. Research suggests that future work should investigate the strategic placement of monitors and the novel optimization of Internet routing measurements [15; 47; 48]. However, historical research conducted on peer monitor selection and collector infrastructure, while significant, has largely been topologically based [49; 50]. Topological methods do not capture the high-dimensional dynamics of the communication system (BGP) nor the interactions and information of ASs at the group level. The hypothesis in this regard is straightforward; can a technique that captures the group interactions, dynamics, and information of ASs provide more information to detect advanced BGP attacks that currently avoid known techniques? In addition to the reliance on route collection infrastructure as an already identified reason for monitor-evasive attacks defeating extant anomaly detection approaches, we also hypothesize that all known detection schemes are largely focused on, and limited to, single observables that can be used to analyze an AS and BGP activity from single monitoring points.