# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 3 BGP Anomalies and Attacks
### Subprefix Attacks  
Subprefix hijacking, a nuanced form of the BGP routing attack, has garnered attention for its ability to surreptitiously divert Internet traffic through unauthorized paths, thereby enabling a range of malicious activities, including traffic interception, surveillance, and potentially data manipulation. In a traditional subprefix hijack, a malicious AS intentionally announces a more specific IP prefix than that of the legitimate owner, effectively luring traffic destined for the legitimate prefix towards the attacker. Given the BGP's preference for more specific prefixes in its routing decisions, routers across the Internet are duped into redirecting traffic through the malicious AS, often unbeknownst to both the legitimate prefix owner and the unsuspecting users whose data are now at the mercy of the attacker. The implications of traditional subprefix hijacks can be devastating, enabling attackers to eavesdrop on data, perform adversary-in-the-middle attacks, or even blackhole traffic, thereby disrupting communication and potentially causing significant operational and reputational damage.  
In the scenario illustrated in Figure 4, ASA (the attacker) perpetrates a subprefix hijack by falsely announcing ownership of a more specific IP prefix, 172.22.0.0/20, which is a subset of ASV's (the victim's) legitimately owned broader prefix, 172.22.0.0/16. This strategic announcement by ASA leverages the BGP's longest prefix match rule, misleading ASX, ASY, and ASZ into routing traffic that was intended for ASV through ASA instead. ASA's manipulation of the BGP's routing decisions not only intercepts the traffic destined for ASV but also potentially subjects it to unauthorized surveillance or manipulation. By exploiting this fundamental aspect of BGP routing, ASA effectively diverts Internet traffic, undermining the integrity and confidentiality of data transmissions to ASV.  
Prepended subprefix hijacking not only announces a more specific prefix but also manipulates the AS path through prepending, artificially inflating the path length in a bid to influence routing decisions subtly. While the BGP inherently prefers shorter AS  
Figure 3: Prefix hijack.  
paths, strategic prepending allows the attacker to craftily manipulate traffic flows, enabling them to target specific ASs or regions without causing widespread disruption or detection. The subtlety of prepended subprefix hijacks poses significant challenges in their detection and mitigation, as their malicious routes may not universally propagate and may only impact specific, targeted portions of the Internet.  
Both traditional and prepended subprefix hijacks exploit the BGP's preference for more specific prefixes and its trust-based operational paradigm, yet they differ in their execution, stealth, and potential detectability. Mitigating such attacks necessitates a multi-faceted approach, involving the deployment of prefix filtering, Route Origin Authorization (ROA), and the adoption of the Resource Public Key Infrastructure (RPKI) to validate the authenticity of BGP announcements. However, the decentralized nature of the BGP and the varied adoption of security practices across ASs worldwide continue to pose hurdles in universally securing the BGP against subprefix hijacks. Improved anomaly detection technologies and capabilities are required.