@conference {18614,
	title = {Wide-area routing dynamics of malicious networks},
	booktitle = {Proceedings of the ACM SIGCOMM 2011 conference},
	series = {SIGCOMM {\textquoteright}11},
	year = {2011},
	month = {2011///},
	pages = {432 - 433},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {This paper studies the routing dynamics of malicious networks. We characterize the routing behavior of malicious networks on both short and long timescales. We find that malicious networks more consistently advertise prefixes with short durations and long inter- arrival times; over longer timescales, we find that malicious ASes connect with more upstream providers than legitimate ASes, and they also change upstream providers more frequently.},
	keywords = {BGP, Security, spam},
	isbn = {978-1-4503-0797-0},
	doi = {10.1145/2018436.2018505},
	url = {http://doi.acm.org/10.1145/2018436.2018505},
	author = {Konte,Maria and Feamster, Nick}
}
@conference {18610,
	title = {Understanding the network-level behavior of spammers},
	booktitle = {Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications},
	series = {SIGCOMM {\textquoteright}06},
	year = {2006},
	month = {2006///},
	pages = {291 - 302},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {This paper studies the network-level behavior of spammers, including: IP address ranges that send the most spam, common spamming modes (e.g., BGP route hijacking, bots), how persistent across time each spamming host is, and characteristics of spamming botnets. We try to answer these questions by analyzing a 17-month trace of over 10 million spam messages collected at an Internet "spam sinkhole", and by correlating this data with the results of IP-based blacklist lookups, passive TCP fingerprinting information, routing information, and botnet "command and control" traces.We find that most spam is being sent from a few regions of IP address space, and that spammers appear to be using transient "bots" that send only a few pieces of email over very short periods of time. Finally, a small, yet non-negligible, amount of spam is received from IP addresses that correspond to short-lived BGP routes, typically for hijacked prefixes. These trends suggest that developing algorithms to identify botnet membership, filtering email messages based on network-level properties (which are less variable than email content), and improving the security of the Internet routing infrastructure, may prove to be extremely effective for combating spam.},
	keywords = {BGP, botnet, network management, Security, spam},
	isbn = {1-59593-308-5},
	doi = {10.1145/1159913.1159947},
	url = {http://doi.acm.org/10.1145/1159913.1159947},
	author = {Ramachandran,Anirudh and Feamster, Nick}
}
@article {18545,
	title = {An empirical study of "bogon" route advertisements},
	journal = {SIGCOMM Comput. Commun. Rev.},
	volume = {35},
	year = {2005},
	month = {2005/01//},
	pages = {63 - 70},
	abstract = {An important factor in the robustness of the interdomain routing system is whether the routers in autonomous systems (ASes) filter routes for "bogon" address space---i.e., private address space and address space that has not been allocated by the Internet Assigned Numbers Authority (IANA). This paper presents an empirical study of bogon route announcements, as observed at eight vantage points on the Internet. On average, we observe several bogon routes leaked every few days; a small number of ASes also temporarily leak hundreds of bogon routes. About 40\% of these bogon routes are not withdrawn for at least a day. We observed 110 different ASes originating routes for bogon prefixes and a few ASes that were responsible for advertising a disproportionate number of these routes. We also find that some ASes that do filter unallocated prefixes continue to filter them for as long as five months after they have been allocated, mistakenly filtering valid routes. Both of these types of delinquencies have serious implications: the failure to filter valid prefixes can could make nefarious activities such as denial of service attacks difficult to trace; failure to update filters when new prefixes are allocated prevents legitimate routes from being globally visible.},
	keywords = {anomalies, BGP, bogon prefixes},
	isbn = {0146-4833},
	doi = {10.1145/1052812.1052826},
	url = {http://doi.acm.org/10.1145/1052812.1052826},
	author = {Feamster, Nick and Jung,Jaeyeon and Balakrishnan,Hari}
}
@conference {18575,
	title = {Implications of autonomy for the expressiveness of policy routing},
	booktitle = {Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications},
	series = {SIGCOMM {\textquoteright}05},
	year = {2005},
	month = {2005///},
	pages = {25 - 36},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Thousands of competing autonomous systems must cooperate with each other to provide global Internet connectivity. Each autonomous system (AS) encodes various economic, business, and performance decisions in its routing policy. The current interdomain routing system enables each AS to express policy using rankings that determine how each router inthe AS chooses among different routes to a destination, and filters that determine which routes are hidden from each neighboring AS. Because the Internet is composed of many independent, competing networks, the interdomain routing system should provide autonomy, allowing network operators to set their rankings independently, and to have no constraints on allowed filters. This paper studies routing protocol stability under these conditions. We first demonstrate that certain rankings that are commonly used in practice may not ensure routing stability. We then prove that, when providers can set rankings and filters autonomously, guaranteeing that the routing system will converge to a stable path assignment essentially requires ASes to rank routes based on AS-path lengths. We discuss the implications of these results for the future of interdomain routing.},
	keywords = {autonomy, BGP, Internet, policy, protocol, Routing, Safety, stability},
	isbn = {1-59593-009-4},
	doi = {10.1145/1080091.1080096},
	url = {http://doi.acm.org/10.1145/1080091.1080096},
	author = {Feamster, Nick and Johari,Ramesh and Balakrishnan,Hari}
}
@conference {18552,
	title = {BorderGuard: detecting cold potatoes from peers},
	booktitle = {Proceedings of the 4th ACM SIGCOMM conference on Internet measurement},
	series = {IMC {\textquoteright}04},
	year = {2004},
	month = {2004///},
	pages = {213 - 218},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Internet Service Providers often establish contractual "peering" agreements, where they agree to forward traffic to each other{\textquoteright}s customers at no cost. <i>Consistent route advertisement at all peering points</i> is a common provision in these agreements, because it gives an AS the flexibility to select egress points for the traffic (e.g., performing "hot potato" routing). Verifying "consistent export" is challenging because route advertisements are exchanged at multiple peering points and may be modified by routing policies. In this paper, we propose two algorithms to detect inconsistent routes using routing and configuration data from an AS{\textquoteright}s border routers. The first algorithm requires access to all eBGP routes advertised by a peer. Because this data is often unavailable, we propose another algorithm that detects inconsistencies using readily available data. We have applied our algorithms to the routes advertised by the peers of AT\&T{\textquoteright}s commercial IP backbone. Although a peer may intentionally send inconsistent advertisements to prevent its neighbor from performing hot-potato routing, we also discuss several configuration scenarios where a peer may <i>inadvertently</i> advertise inconsistent routes, despite having consistent export policies. Finally, we explain how simple modifications to the routers could make detection of inconsistent advertisements much easier than it is today.},
	keywords = {anomalies, BGP, inconsistent advertisement, peering},
	isbn = {1-58113-821-0},
	doi = {10.1145/1028788.1028815},
	url = {http://doi.acm.org/10.1145/1028788.1028815},
	author = {Feamster, Nick and Mao,Zhuoqing Morley and Rexford,Jennifer}
}
@conference {18602,
	title = {The case for separating routing from routers},
	booktitle = {Proceedings of the ACM SIGCOMM workshop on Future directions in network architecture},
	series = {FDNA {\textquoteright}04},
	year = {2004},
	month = {2004///},
	pages = {5 - 12},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Over the past decade, the complexity of the Internet{\textquoteright}s routing infrastructure has increased dramatically. This complexity and the problems it causes stem not just from various new demands made of the routing infrastructure, but also from fundamental limitations in the ability of today{\textquoteright}s distributed infrastructure to scalably cope with new requirements.The limitations in today{\textquoteright}s routing system arise in large part from the fully distributed path-selection computation that the IP routers in an autonomous system (AS) must perform. To overcome this weakness, interdomain routing should be separated from today{\textquoteright}s IP routers, which should simply forward packets (for the most part). Instead, a separate Routing Control Platform (RCP) should select routes on behalf of the IP routers in each AS and exchange reachability information with other domains.Our position is that an approach like RCP is a good way of coping with complexity while being responsive to new demands and can lead to a routing system that is substantially easier to manage than today. We present a design overview of RCP based on three architectural principles path computation based on a consistent view of network state, controlled interactions between routing protocol layers, and expressive specification of routing policies and discuss the architectural strengths and weaknesses of our proposal.},
	keywords = {BGP, interdomain routing, routing architecture},
	isbn = {1-58113-942-X},
	doi = {10.1145/1016707.1016709},
	url = {http://doi.acm.org/10.1145/1016707.1016709},
	author = {Feamster, Nick and Balakrishnan,Hari and Rexford,Jennifer and Shaikh,Aman and van der Merwe,Jacobus}
}
@article {18542,
	title = {A model of BGP routing for network engineering},
	journal = {SIGMETRICS Perform. Eval. Rev.},
	volume = {32},
	year = {2004},
	month = {2004/06//},
	pages = {331 - 342},
	abstract = {The performance of IP networks depends on a wide variety of dynamic conditions. Traffic shifts, equipment failures, planned maintenance, and topology changes in other parts of the Internet can all degrade performance. To maintain good performance, network operators must continually reconfigure the routing protocols. Operators configure BGP to control how traffic flows to neighboring Autonomous Systems (ASes), as well as how traffic traverses their networks. However, because BGP route selection is distributed, indirectly controlled by configurable policies, and influenced by complex interactions with intradomain routing protocols, operators cannot predict how a particular BGP configuration would behave in practice. To avoid inadvertently degrading network performance, operators need to evaluate the effects of configuration changes before deploying them on a live network. We propose an algorithm that computes the outcome of the BGP route selection process for each router in a single AS, given only a static snapshot of the network state, without simulating the complex details of BGP message passing. We describe a BGP emulator based on this algorithm; the emulator exploits the unique characteristics of routing data to reduce computational overhead. Using data from a large ISP, we show that the emulator correctly computes BGP routing decisions and has a running time that is acceptable for many tasks, such as traffic engineering and capacity planning.},
	keywords = {BGP, modeling, Routing, traffic engineering},
	isbn = {0163-5999},
	doi = {10.1145/1012888.1005726},
	url = {http://doi.acm.org/10.1145/1012888.1005726},
	author = {Feamster, Nick and Winick,Jared and Rexford,Jennifer}
}
