<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01411193</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-21T21:17:55+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Investigating the Nature of Routing Anomalies: Closing in on Subprefix Hijacking Attacks</title>
            <author role="aut">
              <persName>
                <forename type="first">Johann</forename>
                <surname>Schlamp</surname>
              </persName>
              <email type="md5">a32f25767408f1194e7d0886b089faeb</email>
              <email type="domain">net.in.tum.de</email>
              <idno type="idhal" notation="numeric">995526</idno>
              <idno type="halauthorid" notation="string">1012751-995526</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Ralph</forename>
                <surname>Holz</surname>
              </persName>
              <email type="md5">87efa0cff79fa402ea3362324b834380</email>
              <email type="domain">nicta.com.au</email>
              <idno type="idhal" notation="numeric">995527</idno>
              <idno type="halauthorid" notation="string">1090343-995527</idno>
              <affiliation ref="#struct-300765"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Oliver</forename>
                <surname>Gasser</surname>
              </persName>
              <email type="md5">4cf92f2f8ad4547925f638812b20c6f2</email>
              <email type="domain">net.in.tum.de</email>
              <idno type="idhal" notation="numeric">1612281</idno>
              <idno type="halauthorid" notation="string">1090344-1612281</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-3425-9331</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Andreas</forename>
                <surname>Korsten</surname>
              </persName>
              <email type="md5">8dc9cf3e5b2c714948729a15a8feb3d1</email>
              <email type="domain">net.in.tum.de</email>
              <idno type="idhal" notation="numeric">995529</idno>
              <idno type="halauthorid" notation="string">1090345-995529</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Quentin</forename>
                <surname>Jacquemart</surname>
              </persName>
              <email type="md5">1432948be01def87a69f8f4ec81ac707</email>
              <email type="domain">eurecom.fr</email>
              <idno type="idhal" notation="numeric">995530</idno>
              <idno type="halauthorid" notation="string">1012748-995530</idno>
              <affiliation ref="#struct-421532"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Georg</forename>
                <surname>Carle</surname>
              </persName>
              <email type="md5">58f2e825fcdb5e4a83ee30752a380d2d</email>
              <email type="domain">net.in.tum.de</email>
              <idno type="idhal" notation="numeric">993621</idno>
              <idno type="halauthorid" notation="string">1012752-993621</idno>
              <affiliation ref="#struct-132871"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Ernst</forename>
                <forename type="middle">W.</forename>
                <surname>Biersack</surname>
              </persName>
              <email type="md5">982fd115f0a71b5e3339272f09ab30b0</email>
              <email type="domain">eurecom.fr</email>
              <idno type="idhal" notation="numeric">995531</idno>
              <idno type="halauthorid" notation="string">922732-995531</idno>
              <affiliation ref="#struct-421532"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2016-12-07 10:55:31</date>
              <date type="whenModified">2026-01-28 10:52:04</date>
              <date type="whenReleased">2016-12-07 11:00:28</date>
              <date type="whenProduced">2015-04-21</date>
              <date type="whenEndEmbargoed">2018-01-01</date>
              <ref type="file" target="https://hal.science/hal-01411193v1/document">
                <date notBefore="2018-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-01411193v1/file/336978_1_En_12_Chapter.pdf" id="file-1411193-1497009">
                <date notBefore="2018-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01411193</idno>
            <idno type="halUri">https://hal.science/hal-01411193</idno>
            <idno type="halBibtex">schlamp:hal-01411193</idno>
            <idno type="halRefHtml">&lt;i&gt;7th Workshop on Traffic Monitoring and Analysis (TMA)&lt;/i&gt;, Apr 2015, Barcelona, Spain. pp.173-187, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-17172-2_12"&gt;&amp;#x27E8;10.1007/978-3-319-17172-2_12&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">7th Workshop on Traffic Monitoring and Analysis (TMA), Apr 2015, Barcelona, Spain. pp.173-187, &amp;#x27E8;10.1007/978-3-319-17172-2_12&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1411193-1497009"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="EURECOM">EURECOM</idno>
            <idno type="stamp" n="IFIP-LNCS" corresp="IFIP">IFIP - Lecture Notes in Computer Science</idno>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC6" corresp="IFIP-TC">TC 6: Communication Systems</idno>
            <idno type="stamp" n="IFIP-TMA">IFIP-TMA</idno>
            <idno type="stamp" n="IFIP-WG6-6">Management of Networks and Distributed Systems</idno>
            <idno type="stamp" n="IFIP-LNCS-9053" corresp="IFIP-LNCS">Traffic Monitoring and Analysis</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 4: Security</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Investigating the Nature of Routing Anomalies: Closing in on Subprefix Hijacking Attacks</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Johann</forename>
                    <surname>Schlamp</surname>
                  </persName>
                  <email type="md5">a32f25767408f1194e7d0886b089faeb</email>
                  <email type="domain">net.in.tum.de</email>
                  <idno type="idhal" notation="numeric">995526</idno>
                  <idno type="halauthorid" notation="string">1012751-995526</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Ralph</forename>
                    <surname>Holz</surname>
                  </persName>
                  <email type="md5">87efa0cff79fa402ea3362324b834380</email>
                  <email type="domain">nicta.com.au</email>
                  <idno type="idhal" notation="numeric">995527</idno>
                  <idno type="halauthorid" notation="string">1090343-995527</idno>
                  <affiliation ref="#struct-300765"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Oliver</forename>
                    <surname>Gasser</surname>
                  </persName>
                  <email type="md5">4cf92f2f8ad4547925f638812b20c6f2</email>
                  <email type="domain">net.in.tum.de</email>
                  <idno type="idhal" notation="numeric">1612281</idno>
                  <idno type="halauthorid" notation="string">1090344-1612281</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-3425-9331</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Andreas</forename>
                    <surname>Korsten</surname>
                  </persName>
                  <email type="md5">8dc9cf3e5b2c714948729a15a8feb3d1</email>
                  <email type="domain">net.in.tum.de</email>
                  <idno type="idhal" notation="numeric">995529</idno>
                  <idno type="halauthorid" notation="string">1090345-995529</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Quentin</forename>
                    <surname>Jacquemart</surname>
                  </persName>
                  <email type="md5">1432948be01def87a69f8f4ec81ac707</email>
                  <email type="domain">eurecom.fr</email>
                  <idno type="idhal" notation="numeric">995530</idno>
                  <idno type="halauthorid" notation="string">1012748-995530</idno>
                  <affiliation ref="#struct-421532"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Georg</forename>
                    <surname>Carle</surname>
                  </persName>
                  <email type="md5">58f2e825fcdb5e4a83ee30752a380d2d</email>
                  <email type="domain">net.in.tum.de</email>
                  <idno type="idhal" notation="numeric">993621</idno>
                  <idno type="halauthorid" notation="string">1012752-993621</idno>
                  <affiliation ref="#struct-132871"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Ernst</forename>
                    <forename type="middle">W.</forename>
                    <surname>Biersack</surname>
                  </persName>
                  <email type="md5">982fd115f0a71b5e3339272f09ab30b0</email>
                  <email type="domain">eurecom.fr</email>
                  <idno type="idhal" notation="numeric">995531</idno>
                  <idno type="halauthorid" notation="string">922732-995531</idno>
                  <affiliation ref="#struct-421532"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">Lecture Notes in Computer Science</title>
                <meeting>
                  <title>7th Workshop on Traffic Monitoring and Analysis (TMA)</title>
                  <date type="start">2015-04-21</date>
                  <date type="end">2015-04-24</date>
                  <settlement>Barcelona</settlement>
                  <country key="ES">Spain</country>
                </meeting>
                <editor>Moritz Steiner</editor>
                <editor>Pere Barlet-Ros</editor>
                <editor>Olivier Bonaventure</editor>
                <imprint>
                  <biblScope unit="serie">Traffic Monitoring and Analysis</biblScope>
                  <biblScope unit="volume">LNCS-9053</biblScope>
                  <biblScope unit="pp">173-187</biblScope>
                  <date type="datePub">2015</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-17172-2_12</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halDomain" n="info.info-ni">Computer Science [cs]/Networking and Internet Architecture [cs.NI]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>The detection of BGP hijacking attacks has been at the focus of research for more than a decade. However, state-of-the-art techniques fall short of detecting subprefix hijacking, where smaller parts of a victim’s networks are targeted by an attacker. The analysis of corresponding routing anomalies, so-called subMOAS events, is tedious since these anomalies are numerous and mostly have legitimate reasons.In this paper, we propose, implement and test a new approach to investigate subMOAS events. Our method combines input from several data sources that can reliably disprove malicious intent. First, we make use of the database of a Internet Routing Registry (IRR) to derive business relations between the parties involved in a subMOAS event. Second, we use a topology-based reasoning algorithm to rule out subMOAS events caused by legitimate network setups. Finally, we use Internet-wide network scans to identify SSL-enabled hosts in a large number of subnets. Where we observe that public/private key pairs do not change during an event, we can eliminate the possibility of an attack. We can show that subprefix announcements with multiple origins are harmless for the largest part. This significantly reduces the search space in which we need to look for hijacking attacks.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 6</org>
              <org type="consortium">WG 6.6</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-132871" status="VALID">
          <idno type="IdRef">031660150</idno>
          <idno type="ISNI">0000000123369749</idno>
          <idno type="ROR">https://ror.org/02kkvpp62</idno>
          <idno type="Wikidata">Q157808</idno>
          <orgName>Technische Universität Munchen = Technical University Munich = Université Technique de Munich</orgName>
          <orgName type="acronym">TUM</orgName>
          <date type="start">1868-01-01</date>
          <desc>
            <address>
              <addrLine>Arcisstrasse 21, D- 80333 München</addrLine>
              <country key="DE"/>
            </address>
            <ref type="url">https://www.tum.de</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-300765" status="VALID">
          <orgName>National ICT Australia [Sydney]</orgName>
          <orgName type="acronym">NICTA</orgName>
          <desc>
            <address>
              <country key="AU"/>
            </address>
            <ref type="url">https://www.nicta.com.au</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-421532" status="VALID">
          <orgName>Eurecom [Sophia Antipolis]</orgName>
          <desc>
            <address>
              <addrLine>Campus SophiaTech, 450 Route des Chappes, CS 50193 - 06904 Biot Sophia Antipolis cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.eurecom.fr/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>