# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 6 Attacks that Require Advanced Detection
### Prefix Hijacking  
Traditional prefix hijacking is not characterized by stealthiness or evasion tactics designed to bypass detection mechanisms. It is relatively straightforward and detectable by several extant monitoring systems that look for anomalies in prefix ownership. It is a direct, simple attack that does not inherently involve the sophisticated manipulation of routing information, eitehr collaborative or distributed nature, or stealthiness and evasion tactics that would necessarily require a group-level analysis for detection. While it does affect routing across multiple ASs, the nature of the attack and its detection do not require the nuanced understanding of AS interactions and dynamics envisioned for more complex attacks. While prefix hijacking is typically an attack executed by a single AS, the impact of the attack is distributed across the Internet, affecting data paths across multiple ASs. However, the attack itself does not involve collusion between these ASs. Therefore, this criterion may not strongly apply to prefix hijacking. However, prefix hijacking, by its nature, can significantly benefit from early detection through multi-vantage point analysis. Discrepancies in BGP announcements, such as an unauthorized AS announcing a prefix it does not own, can be more readily identified when data from multiple points in the Internet are analyzed. This comprehensive view allows for \begin{table}
\begin{tabular}{l l} \hline \hline
**Criteria Type** & **Description** \\ \hline Inclusion 3 & Attacks that involve complex interactions across multiple Autonomous Systems, especially those that require an understanding of the dynamics of AS relationships to be detected (complex interactions across ASs). \\ \hline Inclusion 4 & Attacks that involve the advanced manipulation of routing information, where attackers leverage in-depth knowledge of the BGP to craft attacks that are difficult to detect without analyzing group-level interactions and dynamics (sophisticated manipulation of routing information). \\ \hline Inclusion 5 & Attacks that employ stealthy maneuvers or aim to evade detection by conventional public inter-domain routing monitoring and collector infrastructure. This includes attacks that manipulate AS path attributes or selectively announce paths to bypass detection by public route collectors (stealthiness and evasive techniques). \\ \hline Exclusion 1 & Attacks that are direct and lack complexity, such as simple prefix hijacking without any evasion tactics, might not benefit as much from a multi-vantage point approach since they can often be detected by conventional means (direct, simple attacks). \\ \hline Exclusion 2 & Attacks that do not directly involve BGP manipulation and predominantly rely on vulnerabilities outside the BGP protocol itself (non-BGP layered attacks). \\ \hline Exclusion 3 & Attacks whose impact on routing decisions is not strategic or does not involve the manipulation of BGP attributes or paths. This includes attacks that, while they may cause disruption, do not require an understanding of the BGP’s decision-making process or the relationships between ASs to be detected or mitigated. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._ \begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline
**Attack Type/Criterion** & **I1** & **I2** & **I3** & **I4** & **I5** & **E1** & **E2** & **E3** \\ \hline Prefix Hijacking & Y & N & N & N & N & Y & N & N \\ Subprefix & Y & N & Y & Y & Y & N & N \\ AS Path Forgery & Y & N & Y & Y & Y & N & N & N \\ AS Path Poisoning & Y & N & Y & Y & Y & N & N & N \\ Interception Attacks & Y & N & Y & Y & Y & N & N & N \\ Replay and Suppression & Y & N & Y & N & N & N & N & N \\ Collusion Attack & Y & Y & Y & Y & Y & N & N & N \\ MED and RFD/MRAI & Y & N & Y & Y & Y & N & N & N \\ Community Manipulation & Y & N & Y & Y & Y & N & N & N \\ Denial-of-Service (DoS) & P & N & P & P & P & P & P & P \\ Monitor Evasive & Y & Y & Y & Y & Y & N & N & N \\ \hline \hline \end{tabular} Note: Yes = Y, No = N, Partially = P.  
\end{table}