Design And Implementation Of Real-Time Security Monitoring System For Inter-domain Routing

Inter-domain routing system is critical part of the global communications infrastructure. However as a key part of the Internet, inter-domain routing system has severe healthy problems because of its own frangibility.After analyzing current issues and researches about the security of inter-domain routing deeply, we conclude that the problem should be studied at three levels of inter-domain routing system, which are management plane, control plane and forwarding plane. Since the deployment of the new inter-domain routing protocol, e.g. S-BGP, is confronted with many obstacles, monitoring is an effectinve and pratical method to ensure the healthy inter-domain routing system base on the current network devices. The main contributions are follows:1. Research about security problem of Inter-domain route. We design a real-time security monitoring system which has real-time ability to detect anomaly of traffic and illegal route after reviewing security accident of Inter-domain route, analyzing the protection of Inter-domain route and deficiencies of existent monitoring systems.2. Design two detect arithmetics. Detection for anomalous traffic behavior base on learning and anomaly route base on ruler date-base. Design of whole system under the direction of arithmetics before.3. Implementation of Real-Time Security Monitoring System. We call the system Packet-Censor. It is proved that Packet-Censor has ability of traffic pattern monitoring and anomalous routes monitoring. To detect latent anomalous routes system uses view-sharing to analyze BGP-Table collected from monitors. This method gives system ability to detect anomalous routes base on more complex topology.4. We design and implement a series of initiative testing tools for test and experiment of system.5. Extend system ability to support inter-domain monitoring under IPv6.