Because of operational malpractice or security attacks, every Internet IP prefix (i.e., every block of IP addresses) can undergo various routing anomalies, causing business loss, identity theft, or many other devastating effects. For example, in prefix hijacking, an attacker can hijack traffic toward legitimate users of a prefix. However, a solution that is both effective in monitoring anomalies and resilient against attacker circumvention is yet to be seen. This research will investigate, design, and evaluate a new approach to reliable monitoring of IP prefixes. Dubbed Buddyguard, it surrounds a prefix with a buddy system composed of buddy prefixes, or buddies, and monitors the behavior of the prefix against its buddies. The scientific contributions will include: (i) A Buddyguard architecture for monitoring routing anomalies of IP prefixes, including various difficult prefix hijacking cases; (ii) A buddy discovery, selection and maintenance algorithm to choose buddies for a monitored prefix, including a rigorous analysis on what and how many buddies are needed to effectively detect routing anomalies and be resilient against attackers? circumvention; (iii) A scalable and easy-to-deploy algorithm to use a prefix?s buddies to detect routing anomalies reliably, quickly, and resiliently; and (iv) A deep and thorough understanding on the feasibility, advantages, performance, and limitations of using a buddy system for prefix monitoring. Once deployed, Buddyguard will be offered as a service to the public. The results as well as tools, software code, and documents from this research will also be disseminated. This research also incorporates a solid curriculum and education plan.
