域间路由中间人攻击的实时检测系统  

Real-time system for detecting inter-domain routing man-in-the-middle attacks

作　　者：黎松[1] 段海新[2] 李星[1,2] 

机构地区：[1]清华大学电子工程系,北京100084 [2]清华大学网络科学与网络空间研究院,北京100084

出　　处：《清华大学学报（自然科学版）》2015年第11期1229-1234,共6页Journal of Tsinghua University(Science and Technology)

基　　金：国家自然科学基金面上项目(61472215)

摘　　要：针对域间路由中间人攻击这一域间路由安全面临的新威胁,建立攻击模型并分析其在路由控制平面和数据平面所产生的异常特征,进而提出一种域间路由中间人攻击的实时检测系统。该系统首先通过控制平面异常监控发现可疑的异常路由,之后进行数据平面转发路径探测以鉴别该异常是否为域间路由中间人攻击。实际网络部署的测试结果表明:该系统是轻量级的,并能实时有效地检测出可能的域间路由中间人攻击。Man-in the middle attacks have become a new serious threat to inter-domain routing. This paper presents a real-time system for detecting inter-domain routing man-in-the-middle attacks based on an analysis of a threat model and key features in the control plane and the data plane. The detection system first monitors the anomalous route in the control plane and then probes the data plane to identify the inter-domain routing man-in-the-middle attack. Internet tests show that the detection system is light-weight and effectively detects probable man-in-the-middle attacks in inter-domain routing in real time.

关 键 词：域间路由 前缀劫持 中间人攻击 检测 

分 类 号：TP393.4[自动化与计算机技术—计算机应用技术]