A Cooperative Method for Prefix Hijack Detection in the Internet

The problem of detecting prefix hijacks in the Internet remains a challenging problem, when considering no single completely accurate source of truth about which organizations have the authority to advertise which prefixes. This paper proposes a method, called Co-Monitor, for prefix hijack detection based on cooperation. In the Co-Monitor overlay network, participating ASes exchange prefix-to-origin mappings defined by them. Through cooperative monitoring, such an event that the prefix origin of a route is inconsistent with the requested mapping can be detected in a comprehensive monitoring scope. To ensure the accuracy, the method adopts source verifying mechanism to confirm prefix hijacks because an announcer answers for its prefixes. We conduct experiments to evaluate the capabilities of the cooperative monitoring method, and results show that ASes have much incentive to join the co-monitor architecture.