💻 computer science

Understanding the Stealthy BGP Hijacking Risk in the ROV Era

This paper introduces the concept of stealthy BGP hijacking, a threat where malicious routes evade detection by victims due to partial Route Origin Validation (ROV) deployment, and addresses it through the first empirical study of real-world incidents and the development of SHAMAN, a high-efficiency framework that reveals a significant global risk with up to 99.5% success probability for targeted attacks.

Original authors: Yihao Chen, Qi Li, Ke Xu, Zhuotao Liu, Jianping Wu

Published 2026-06-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yihao Chen, Qi Li, Ke Xu, Zhuotao Liu, Jianping Wu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The Internet's Address Book

Imagine the Internet is a massive, global postal system. Every computer and server has an address (an IP prefix), and every post office (called an Autonomous System or AS) has a rulebook on how to deliver mail. The protocol that keeps these rulebooks in sync is called BGP.

The problem? The old rulebook has a huge security flaw: anyone can walk into a post office and say, "Hey, I own this address! Send all the mail for this neighborhood to me!" If the other post offices believe them, they send all the traffic there. This is called BGP Hijacking. Usually, this is obvious because the mail gets lost or goes to the wrong place immediately.

The New "Security Guard": ROV

To fix this, the internet community introduced a security guard system called RPKI and ROV (Route Origin Validation).

The Analogy: Imagine a "Verified Owner" list. Before a post office accepts a new delivery instruction, it checks this list. If the instruction says, "I am the owner," but the list says, "No, that's not you," the post office rejects the fake instruction.

The Catch: Not every post office has hired this security guard yet. As of the paper's writing, only about 10% of the world's post offices use ROV. The rest are still using the old, insecure rulebook.

The "Stealthy" Trap: The Invisible Hijack

This is where the paper's main discovery comes in. The authors found that having some security guards actually creates a new, invisible type of hijacking called Stealthy BGP Hijacking.

The Analogy of the Invisible Thief:

The Victim (AS A): A post office that has hired the security guard (ROV).
The Target (AS E): A legitimate business that owns a specific address.
The Thief (AS G): A criminal trying to steal traffic meant for the Target.
The Middleman (AS C): A post office that has not hired a security guard.

Here is how the theft happens without the Victim knowing:

The Thief tries to tell the Victim, "I own the Target's address!"
The Victim's security guard (ROV) checks the list, sees the Thief is fake, and blocks the message. The Victim never even knows the Thief exists.
However, the Thief does tell the Middleman (AS C). The Middleman has no security guard, so it believes the Thief.
The Victim sends mail to the Target. The mail travels through the Middleman.
The Middleman, believing the Thief, diverts the mail to the Thief's house.
The Result: The Victim thinks, "I'm sending mail to the Target," but the mail is actually being stolen by the Thief. Because the Victim's security guard blocked the announcement of the theft, the Victim remains completely unaware. It's a "silent" theft.

What the Researchers Did

The authors, led by Yihao Chen and colleagues, wanted to understand how big this problem is. They couldn't just wait for people to report it, because the victims don't know they are being robbed.

The Detective Work (Empirical Study): They built a system to scan the internet's "mail logs" (routing tables) from different vantage points. They looked for discrepancies: "I see a route to the Target, but I don't see a route to the Thief, yet the path to the Target goes through someone who could talk to the Thief."
- They found 318 high-confidence real-world incidents of this happening.
- They discovered that these attacks are often short-lived but happen almost daily.
The Super-Computer (SHAMAN Framework): To understand the full risk, they needed to simulate the entire internet. Existing methods were too slow (taking months to calculate routes for the whole world).
- They built a tool called SHAMAN (named after a guide who navigates unseen perils).
- The Magic Trick: Instead of simulating every single post office one by one, they used a mathematical "matrix" approach (like a giant spreadsheet) to calculate all possible routes at once.
- The Speedup: They reduced the time to map the entire internet's routes from over 3 months to just 5.22 hours.

The Shocking Findings

Using their super-fast tool, they analyzed 8.3 billion possible routes. Here is what they found:

The Success Rate: Even with the security guards in place, a random "stealthy" hijacking attempt has a 14.1% chance of success.
The Targeted Danger: If a thief specifically targets a victim and a specific route, the success rate can jump to 99.5%. It's almost a guaranteed theft.
The "Double-Edged Sword": ROV is great at stopping obvious hijacking (where the thief announces the route and everyone sees it). But because it hides the thief from the victim, it accidentally makes stealthy hijacking much more likely.
The "Vital Few": The risk isn't spread evenly. Just 2.9% of the "Middleman" post offices are responsible for 80% of all these stealthy thefts. If you fix those few, you fix most of the problem.
The Future: As more post offices hire security guards, the risk will go up for a while, but eventually, if everyone has a guard, the risk will drop back to zero. We are currently in the "risk rising" phase.

Summary

The paper reveals a paradox: Partial security creates a new kind of invisibility. By blocking bad announcements for some people but not others, the internet has created a blind spot where traffic can be stolen without the owner ever knowing. The authors built a fast, mathematical tool to map this danger and showed that while the risk is currently significant, it is concentrated in a small number of key locations, offering a clear path for fixing it.

Technical Summary: Understanding the Stealthy BGP Hijacking Risk in the ROV Era

1. Problem Statement

The Border Gateway Protocol (BGP) is vulnerable to hijacking, where malicious Autonomous Systems (ASes) falsely announce IP prefixes to divert traffic. To mitigate this, the community has deployed Route Origin Validation (ROV) using the Resource Public Key Infrastructure (RPKI). ROV-enabled ASes verify BGP announcements against Route Origin Authorizations (ROAs) and discard invalid routes.

However, ROV deployment is currently partial and incomplete. This paper identifies an unexpected security threat arising from this partial deployment: Stealthy BGP Hijacking.

The Mechanism: In a partial ROV environment, a victim AS (protected by ROV) may not receive the malicious route announcement because a neighboring ROV-enabled AS filters it out. Consequently, the victim's routing table lacks a route to the hijacker, rendering the attack invisible on the control plane.
The Reality: Despite the victim's routing table appearing clean, traffic destined for a legitimate target may traverse a "legacy" (non-ROV) AS along the data path. If this legacy AS accepts the malicious route (e.g., due to policy preferences or sub-prefix announcements), it diverts the victim's traffic to the hijacker.
The Gap: This form of hijacking is "stealthy" because the victim remains unaware of the malicious route, making standard control-plane defenses ineffective. Prior to this work, there were no documented real-world incidents, no systematic characterization, and no tools to assess the scale of this risk.

2. Methodology

The authors employ a two-pronged approach: an empirical study to discover real-world instances and an analytical framework to assess the global risk.

A. Empirical Discovery (Heuristics)

To identify stealthy hijacking in the wild, the authors formalized the risk and developed heuristics based on routing table discrepancies observed across multiple vantage points (RouteViews collectors).

Formal Definition: A "victim-target-hijacker" 3-tuple $(u, v, w)$ $(u, v, w)$ constitutes a stealthy hijacking instance if:
1. The victim $u$ has a valid route to the target $v$ .
2. The victim $u$ has no route to the hijacker $w$ (due to ROV filtering).
3. An intermediate AS $a_i$ on the path from $u$ to $v$ does have a route to $w$ and forwards traffic to $w$ .
Heuristics: The authors proposed "loose" and "strict" heuristics to detect these instances by cross-referencing RPKI validity, IRR conflicts, and WHOIS mismatches.
Data Collection: They analyzed daily RIB snapshots from January to February 2025, capturing 1,393 potential incidents. After deduplication and validation against a broad knowledge base (RPKI, IRR, WHOIS), they curated a high-confidence dataset of 318 real-world incidents covering 2,178 routes.

B. Analytical Framework (SHAMAN)

To move beyond observation and perform a deterministic, Internet-wide risk assessment, the authors developed SHAMAN, a BGP route inference framework.

Input Consolidation: SHAMAN aggregates ROV deployment data from three sources (APNIC, RoVista, Cloudflare) to construct an accurate view of which ASes are ROV-enabled.
Topology Compression: It reconstructs the Internet topology and compresses it by removing single-homed ASes (which can be derived from upstreams), reducing the vertex count by ~36%.
Matrix-Based Route Inference:
- Instead of traditional simulation, SHAMAN uses a matrix-based approach with a unique one-byte encoding scheme for route priority (encoding Local Preference and Path Length).
- It performs iterative matrix updates to infer complete AS-level routes for both "benign reach" (legitimate paths) and "malicious reach" (paths where ROV blocks propagation).
- This approach reduces the time to generate Internet-scale routes from over three months (using prior art like BGPsim) to 5.22 hours.
Risk Assessment: Using the inferred routes, SHAMAN exhaustively evaluates all "victim-target-hijacker" tuples to calculate the probability of stealthy hijacking success under current ROV deployment levels.

3. Key Contributions

Formalization and Heuristics: The first formal definition of stealthy BGP hijacking and the derivation of heuristics to detect it via routing table discrepancies.
First Empirical Study: The first tracking of stealthy hijacking in the wild, resulting in a curated dataset of 318 high-confidence incidents and a long-term monitoring service.
SHAMAN Framework: A novel, high-performance framework for systematic risk assessment that integrates multi-source ROV data and utilizes matrix operations for efficient, Internet-wide route inference.
Comprehensive Risk Analysis: The first exhaustive assessment of stealthy hijacking risk across 8.3 billion generated routes, providing statistical insights into prevalence, distribution, and topological drivers.

4. Key Results

Success Probability: Under current partial ROV deployment, the overall success probability for stealthy BGP hijacking is 14.1%. In contrast, without ROV, this risk is 0% (as attacks would be direct and visible).
Targeted Attacks: While the average risk is 14.1%, targeted attacks (specific victim-target-hijacker pairs) can achieve a success probability of up to 99.5%.
Double-Edged Sword: Partial ROV deployment successfully reduces direct hijacking risk (sub-prefix direct hijacking drops from ~100% to ~42%) but simultaneously introduces and amplifies stealthy hijacking risk.
Risk Concentration:
- Vital Few: A small fraction of ASes drive the majority of the risk. Specifically, 2.94% of risk-critical ASes (245 out of 8,323) and 2.24% of ROV-enabled ASes (36 out of 1,608) are responsible for 80% of all stealthy hijacking instances.
- Geographic Distribution: Potential hijackers are concentrated in Europe, South America, and North America. Victims are primarily in North America, while targets are concentrated in South America and South Asia.
Evolution Pattern: The risk follows a "rise-then-decline" pattern. As ROV adoption increases from 0%, stealthy risk rises (peaking around current levels). The authors' simulations suggest that once ROV adoption exceeds 40%, the risk begins to decline significantly, approaching zero at near-universal adoption.
Framework Accuracy: Validation against the real-world dataset shows SHAMAN achieves up to 95.9% incident-level accuracy.
Performance: SHAMAN achieves a 500-fold speedup over existing methods (BGPsim), generating routes for 77,600 ASes in 5.22 hours.

5. Significance and Claims

The paper claims to fill a critical gap in BGP security research by exposing a previously unexplored threat vector created by the transition to RPKI/ROV.

Unintended Consequence: The work highlights that partial security deployment can create new, invisible attack surfaces. The "stealthiness" is a byproduct of the current ecosystem's mixed state, not a flaw in ROV itself.
Actionable Insights: By identifying that a tiny fraction of ASes (the "vital few") account for the vast majority of the risk, the paper argues for focused mitigation strategies. Deploying advanced countermeasures (like ROV++ with proactive rerouting) on these specific key ASes could effectively neutralize the majority of the threat.
Methodological Advance: The introduction of SHAMAN demonstrates that Internet-scale, deterministic risk assessment is feasible with efficient matrix-based inference, moving beyond limited sampling or slow simulations.

The authors conclude that while ROV is essential, the current partial deployment phase is a period of heightened, stealthy vulnerability. They advocate for continued monitoring and targeted mitigation on the identified high-risk ASes until global ROV adoption reaches a threshold where the risk naturally collapses.