Patent ID: 8443076

Claim:
A method, comprising: accessing, at a computer device, a data file indicative of a network topology, the network topology comprising a plurality of network locations; determining at the computer device, based on the data file, a first subset of the network locations subject to prefix hijacking events, the first subset contained in a first autonomous system; and selecting a first of the network locations for placement of a first hijacking detections module configured to detect prefix hijacking events directed against the first subset of the network locations, wherein: the first of the network locations is contained in a second autonomous system bordering the first autonomous system; and the detecting prefix hijacking events comprises: receiving Border Gateway Protocol updates from the first autonomous system and from other autonomous systems bordering the second autonomous system; comparing prefixes claimed by the first autonomous system with prefixes claimed by the other autonomous systems; and determining that a Border Gateway Protocol update related to a prefix represents a prefix hijacking even based upon a database indicating that the prefix is already associated with the second autonomous system and is not associated with an autonomous system claiming ownership of the prefix in the Border Gateway Protocol update; and wherein selecting a first of the network locations comprises determining a plurality of candidate locations based on the plurality of network locations, and determining a plurality of detection coverage ratios corresponding to the plurality of candidate locations; wherein determining the plurality of detection coverage ratios comprises: determining a first detection coverage ratio for a first candidate location of the plurality of candidate locations by determining a first number of autonomous systems from which a first hijacking detection module at the first candidate location can detect prefix hijacking events launched at a first target AS, and dividing the first number by a total number of autonomous systems of the network topology that can potentially hijack a prefix of the first target autonomous system.