# RPKI Defense Capability Simulation Method Based on Container Virtualization
## 6 Experimental Verification and Analysis
### Virtual-Real Interconnected Scene Construction and Fidelity Testing  
To verify whether the virtual routers can announce network prefixes and enforce the ROV and to test the fidelity of the simulation technology, we constructed a combined virtual-real simulation network test scenario on the basis of the above experimental environment. AS15169 represents a physical router connected to a host, simulating a router holding a legitimate network prefix. AS5 connects to the real internet through the ext network of OpenStack. The RPs connected to AS1 and AS7 fetch ROAs from the RPKI repository on the internet through AS5. Other BGP neighbor relationships are depicted in Figure 5.  
Using AS15169 as the victim AS and its held prefix 8.8.8.0/24 as the target prefix, we designated AS6 as the malicious attack source in the simulation network. After normal network prefix announcements are made in the network, prefix hijacking and subprefix hijacking attacks were launched. We collected and analyzed the control plane and data plane attack results from the ASes other than the attacker and victim. The specific results are presented in Table 2. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Virtual Node**} & \multicolumn{2}{c}{**Title 2**} & \multicolumn{2}{c}{**Title 3**} \\ \cline{2-5}  & **Prefix Hijacking** & **Subprefix** & **Prefix Hijacking** & **Subprefix** \\  & & **Hijacking** & **Hijacking** \\ \hline AS 1 & Connected & Connected & Connected & Connected \\ AS 2 & Hijacked & Hijacked & Hijacked & Hijacked \\ AS 3 & Connected & Hijacked & Connected & Hijacked \\ AS 4 & Hijacked & Hijacked & Hijacked & Hijacked \\ AS 5 & Hijacked & Hijacked & Hijacked & Hijacked \\ AS 7 & Connected & Connected & Hijacked & Hijacked \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Integrated virtual–real simulation experimental results. The first column in the table shows the impact of the prefix hijacking and subprefix hijacking attacks on the BGP routers at the control plane level. For the ASes deploying the RPKI, both prefix hijacking and subprefix hijacking do not result in route flaps at the control plane. This aligns with the operating principles and defense mechanism of the RPKI. In contrast, for the ordinary ASes without any security defense strategies deployed, each attack leads to route flaps, affecting the stability of the control plane. The second column of data illustrates the impact of the BGP routers at the data plane for the two types of prefix hijacking attacks. In the case of prefix hijacking, AS3, although not deploying the RPKI, gains a higher priority for legitimate prefixes because of a shorter path to AS15169. This aligns with the working principles of the BGP. However, owing to the more specific route, AS3 is affected by the malicious attack in subprefix hijacking. Similar to the results on the control plane, AS1, which deploys the RPKI, can still withstand harm from two prefix hijacking attacks at the data plane level. However, AS7 experiences traffic being hijacked to AS6. This discrepancy between the routing table and the actual data flow in AS7 is mainly because AS7 cannot control how AS5 correctly routes the data to legitimate prefixes. Although AS7 identifies and discards illegal BGP announcements from the malicious AS, when the data are forwarded to AS5, AS5 still routes the data to AS4, resulting in data plane hijacking for AS7. The above experimental results verify the effectiveness of the RPKI in preventing prefix hijacking attacks. Moreover, this simulation scenario supports connections with physical routers and the internet, facilitating standard data communication via the TCP/IP protocol. This shows the fidelity and flexibility of a BGP attack and defense simulation technology based on OpenStack. Additionally, the experimental results for AS7 illustrate the covert nature of BGP subprefix hijacking attacks. Focusing solely on the experimental results at the control plane would lead to a partial conclusion.