Patent ID: 7823202

Claim:
A method for generating a prefix hijacking alert in a network, wherein a plurality of network traffic flows are routed based at least on a plurality of prefix announcements from one or more Border Gateway Protocol (BGP) router, the method comprising: identifying, using a computer, an anomalous prefix from the plurality of prefix announcements; identifying, using the computer, a network traffic anomaly from the plurality of network traffic flows; and correlating, using the computer, the anomalous prefix and the network traffic anomaly to generate the prefix hijacking alert, wherein each of the plurality of prefix announcements comprises an announcement time stamp, a prefix, an origin autonomous system (AS), and an association corresponding to the prefix and the origin AS, and wherein identifying the anomalous prefix comprises: establishing a valid association set based on the plurality of prefix announcements, wherein the valid association set comprises a plurality of associations; receiving a first prefix announcement of the plurality of prefix announcements; comparing a first association of the first prefix announcement to the valid association set; and identifying a first prefix of the first prefix announcement as the anomalous prefix if the first association is not contained in the valid association set, wherein establishing the valid association set comprises: receiving a second prefix announcement of the plurality of prefix announcements, the second prefix announcement having a second announcement time stamp within a first anomalous prefix detection time window with an end point corresponding to a first announcement time stamp of the first prefix announcement; and including a second association of the second prefix announcement in the valid association set if an up time of the second association within the anomalous prefix detection time window exceeds a first pre-determined threshold, wherein each of the plurality of network traffic flows comprises at least one selected from a group consisting of a traffic flow time stamp, a source IP-address, a destination IP-address, a flow size, a network protocol identifier, and a destination port number, the method further comprising: forming a network traffic flow group comprising a portion of the plurality of network traffic flows, each network traffic flow of the network traffic flow group sharing a source IP-address and having each traffic flow time stamp within a second network traffic anomaly detection time window; and determining the network traffic anomaly based on a destination IP-address entropy of a destination IP-address histogram of the network traffic flow group exceeding a pre-determined destination IP-address threshold, the destination IP-address histogram being based on the destination IP-address of each network traffic flow of the network traffic flow group.