The Border Gateway Protocol (BGP) is the Internet’s most crucial protocol for efficient global connectivity and traffic routing. However, BGP is well known to be susceptible to route hijacks and leaks. Route hijacks are the intentional or unintentional illegitimate announcements of network resources that can compromise the confidentiality, integrity, and availability of communication systems. In the past, the so-called “serial hijackers” have hijacked Internet resources multiple times, some lasting for several months or years. So far, only the paper “Profiling BGP Serial Hijackers” has explicitly focused on these repeat offenders, and it dates back to 2019. Back then, they had to process large amounts of BGP announcements to find a few potential serial hijackers. In this paper, we revisit the profiling of serial hijackers. We reproduced the 2019 study and showed that we can identify potential offenders with less data while achieving similar accuracy. Our study confirms that there has been no significant increase in the evolution of serial hijacking activities in the last five years. We then extend their research, further analyze the characteristics of the serial hijackers, and show that most of the alleged serial hijackers are still active on the Internet. We also find that 22.9% of the hijacks violated RPKI objects but were still widely propagated, and that even MANRS participants were among the propagating networks.

The rapid growth of the Internet has raised concerns about the carbon emissions linked to data transmission. Autonomous Systems (ASes), which make inter-domain routing decisions, influence how traffic moves through the network and, indirectly, where emissions are generated. Although carbon-aware routing is gaining interest, limited visibility into emission sources remains a key challenge. In this paper, we present GRASS (Green Ranking of Autonomous SystemS), a framework for estimating the CO2intensity of ASes based on their geographic distribution and the carbon efficiency of regional electricity grids. GRASS combines geolocation, routing, and carbon data to infer probabilistic location profiles and compute a CO2intensity score for each AS. Using GRASS, we analyze emission patterns across AS popularity tiers, and customer cone sizes, and assess the carbon intensity of AS-to-AS links based on associated organizations. Our results show that a small number of structurally central ASes and links account for a large fraction of total Internet-related emissions. We propose a novel approach to assessing the CO2intensity of ASes and their interconnections, offering insights that enable targeted interventions for greener network operations and routing policies.

Remote peering (RP) enables networks to reach Internet Exchange Points (IXPs) without physical presence in the same datacenter/location, offering cost-effective interconnection. However, in the context of anycast, where routing efficiency relies on the assumption that traffic is routed to the geographically nearest instance, RP can undermine this principle by introducing hidden performance costs and inflating paths. This paper presents a hybrid methodology, combining data-plane measurements with control-plane insights, to detect and geolocate RP links at scale using IP-level geolocation, AS-level mapping, and IXP facility data. Using 3 million traceroutes targeting 13,735 anycast /24-prefixes, we quantify the impact of RP on anycast routing.Our analysis shows that whilst RP is widespread, it often connects ASes geographically close to the IXP facility. However, for cases where it is “remote” we find it frequently results in long detours, elevated latency, and sub-optimal anycast site selection. Finally, we identify key ASes and IXP regions that play a central role in driving RP-related detours and locality violations in anycast routing. Our findings demonstrate at Internet scale that RP undermines anycast locality by increasing the likelihood of detours and inflated paths, underscoring the need for improved visibility into interconnection practices that impact latency-sensitive services.

The Border Gateway Protocol (BGP), a cornerstone of global Internet routing, remains vulnerable to various attacks due to its lack of integrated security features and mechanisms to verify the authenticity and integrity of routing information. Although BGPsec was introduced as a standardized solution to address these concerns, it has not seen real-world deployment even after eight years, primarily due to operational complexity and deployment challenges. We present the design and implementation of xBGPsec, a protocol that improves BGP security by attaching digital signatures to BGP updates using optional transitive attributes. These signatures cover both the AS path and dedicated BGP attributes, and are generated and verified by a dedicated external validator, allowing enhanced security without disrupting existing routing operations. To demonstrate the feasibility of this approach, we built a dedicated testbed integrating xBGPsec-enabled routers and a supporting cryptographic infrastructure. This proof-of-concept provides the foundation for future empirical evaluation and offers initial insights for network operators and researchers exploring scalable, interoperable BGP security solutions.

The Border Gateway Protocol (BGP) is a crucial inter-domain routing protocol that uses update messages to enable Autonomous Systems (ASes) to share network reachability information. Typically, ASes should only trigger update messages to reflect configuration changes and link failures for optimal path selection. However, we have identified recurring patterns of highfrequency repeated updates without any topological changes, which consume unnecessary resources of the route collectors for archiving and storage, and complicate downstream analysis. Although the phenomenon of noisy BGP peers and prefixes is known, current work has not quantified its scope and characteristics. This study fills this gap and analyzes over 80 billion update messages from multiple RouteViews collectors spanning several years. We identify and characterize high-frequency repeated updates driven by a small fraction of sessions and prefixes. For instance, fewer than 2% of the prefixes accounted for over 90% of update messages in some BGP update traces.

Besides being the de facto routing protocol of the Internet, the Border Gateway Protocol (BGP) has also been used for mitigating Distributed Denial of Service (DDoS) attacks for many years. In such situations, victims of DDoS attacks use BGP to redirect attack traffic to a “scrubber” outside their network, which separates clean traffic from DDoS traffic and forwards the former to the victim’s network. While there exist many BGP-based DDoS scrubbing providers, their adoption on the global Internet remains unstudied. This paper aims to fill this gap by identifying and characterizing Autonomous Systems (ASes) and prefixes protected by five of the leading scrubbing providers, using AS path patterns in public BGP routing data. Our study focuses on scrubbers that allow their protected ASes to originate their prefixes themselves. We find that the percentage of ASes using this kind of protection has increased almost three times (from 0.7% to 2% and from 464 ASes to 1,730 ASes) between 2020 and 2024. Similarly, the percentage of protected prefixes has also increased three times in the same period, from 0.3% to 0.9% and from 3,154 to 12,362 prefixes, across both IPv4 and IPv6. Globally, we observe a higher adoption rate among financial institutions, while adoption remains low among educational institutions. We believe our insights will be useful for individual AS operators to find the transit providers or peers that are DDoS-protected. It might also be useful for (national) policy-makers to incentivize the adoption of DDoS protection services and for researchers studying the phenomenon of DDoS scrubbing.

The Border Gateway Protocol (BGP) remains susceptible to prefix hijacks due to its trust-based nature and lack of default robust authentication mechanisms. Prefix hijacks are unintentional or malicious announcements of prefixes allocated to other ASes. Although prefix hijacks are primarily associated with misconfigurations, they remain a significant security threat. For instance, the recent hijacking and route leak incident involving Cloudflare made their DNS resolver unreachable for some networks for about 8 hours. Some ASes perform hijacks frequently and for longer duration. We revisited these “serial hijackers” in 2024 and validated some of the potential serial hijackers with external data. However, neither the original study from 2019 nor ours dug deeper to understand the impact and goal of serial hijackers. This study fills this gap and shows that$22.9 \%$of the announcements were RPKI-invalid, raising new questions about the intent of the hijack. Finally, we show that these invalid announcements still reach many networks on the Internet, demonstrating that many ASes are not doing RPKI route origin validation, thereby compromising the Internet's stability and security.

As the backbone of communications amongst objects, humans, companies, and administrations, the Internet has become a great integration platform capable of efficiently interconnecting billions of entities, from RFID chips to data centers. This platform provides access to multiple hardware and virtualized resources (servers, networking, storage, applications, connected objects) coming from cloud computing and Internet-of-Things (IoT) infrastructures. From these resources that may be hosted and distributed amongst different providers and tenants, the building and operation of complex and value-added networked systems is enabled.

As the backbone of communications amongst objects, humans, companies, and administrations, the Internet has become a great integration platform capable of efficiently interconnecting billions of entities, from RFID chips to data centers. This platform provides access to multiple hardware and virtualized resources (servers, networking, storage, applications, connected objects) coming from cloud computing and Internet-of-Things (IoT) infrastructures. From these resources that may be hosted and distributed amongst different providers and tenants, the building and operation of complex and value-added networked systems is enabled.

IP anycast has become a vital technology for DNS and CDN operators alike. Yet, while big operators have their tools to monitor and configure anycast routing, most of anycast networks are still configured manually. In this paper, we introduce a new approach to anycast management. Our solution is based on active measurements combined with traffic engineering. We propose the concept of a "BGP Cookbook" that allows operators to forecast the effects of routing policy changes over their services. We also introduce a web-based interface, called "BGP Anycast Tuner", that allows operators to gain insight into their service's performance and provides easy management through automation. We evaluate our approach by implementing a prototype running in a testbed composed of 12 anycast sites covering 5 continents. We demonstrate our tool in two different use cases: discovering and fixing a sub-optimal anycast routing issue, and shifting traffic between continents, which is useful during service disruptions.

Miscreants abuse thousands of domain names every day by launching large-scale attacks such as phishing or malware campaigns. While some domains are solely registered for malicious purposes, others are benign but get compromised and misused to serve malicious content. Existing methods for their detection can either predict malicious domains at the time of registration or identify indicators of an ongoing malicious activity conflating maliciously registered and compromised domains into common blacklists. Since the mitigation actions for these two types domains are different, we propose COMAR, an approach to differentiate between compromised and maliciously registered domains, complementary to previously proposed domain reputation systems. We start the paper with a thorough analysis of the domain life cycle to determine the relationship between each step and define its associated features. COMAR uses a set of 38 features costly to evade. We evaluate COMAR using phishing and malware blacklists and show that it can achieve high accuracy (97% accuracy with a 2.5% false-positive rate) without using any privileged or non-publicly available data, which makes it suitable for the use by any organization. We plan to deploy COMAR at two domain registry operators of the European country-code TLDs and set up an early notification system to facilitate the remediation of blacklisted domains.

Concern has been mounting about Internet centralization over the few last years -- consolidation of traffic/users/infrastructure into the hands of a few market players. We measure DNS and computing centralization by analyzing DNS traffic collected at a DNS root server and two country-code top-level domains (ccTLDs) -- one in Europe and the other in Oceania -- and show evidence of concentration. More than 30% of all queries to both ccTLDs are sent from 5 large cloud providers. We compare the clouds resolver infrastructure and highlight a discrepancy in behavior: some cloud providers heavily employ IPv6, DNSSEC, and DNS over TCP, while others simply use unsecured DNS over UDP over IPv4. We show one positive side to centralization: once a cloud provider deploys a security feature -- such as QNAME minimization -- it quickly benefits a large number of users.

We present our ongoing work on SPIN, a muchneeded open source measurement platform that enables researchers and other users to easily analyze the security features of devices in the "Internet of Things" (IoT), specifically in-home networks. SPIN accomplishes this by mapping and enhancing network-level measurements in the home network and by making them available through a well-defined interface. This enables all kinds of new applications for research and commercial purposes, such as privacy managers for consumers that visualize insecure IoT devices and their connections, and new algorithms that automatically block botnet traffic to protect the public Internet against IoT-powered DDoS attacks. SPIN is a flexible distributed system that runs in the home network and that keeps users in control. We have validated SPIN in our lab through prototype implementations.

To enhance competition and choice in the domain name system, ICANN introduced the new gTLD program, which added hundreds of new gTLDs (e.g. .nyc, .io) to the root DNS zone. While the program arguably increased the range of domain names available to consumers, it might also have created new opportunities for cybercriminals. To investigate that, we present the first comparative study of abuse in the domains registered under the new gTLD program and legacy gTLDs (18 in total, such as .com, .org). We combine historical datasets from various sources, including DNS zone files, WHOIS records, passive and active DNS and HTTP measurements, and 11 reputable abuse feeds to study abuse across gTLDs. We find that the new gTLDs appear to have diverted abuse from the legacy gTLDs: while the total number of domains abused for spam remains stable across gTLDs, we observe a growing number of spam domains in new gTLDs which suggests a shift from legacy gTLDs to new gTLDs. Although legacy gTLDs had a rate of 56.9 spam domains per 10,000 registrations (Q4 2016), new gTLDs experienced a rate of 526.6 in the same period-which is almost one order of magnitude higher. In this study, we also analyze the relationship between DNS abuse, operator security indicators and the structural properties of new gTLDs. The results indicate that there is an inverse correlation between abuse and stricter registration policies. Our findings suggest that cybercriminals increasingly prefer to register, rather than hack, domain names and some new gTLDs have become a magnet for malicious actors. ICANN is currently using these results to review the existing anti-abuse safeguards, evaluate their joint effects and to introduce more effective safeguards before an upcoming new gTLD rollout.

Over the years cybercriminals have misused the Domain Name System (DNS) - a critical component of the Internet - to gain profit. Despite this persisting trend, little empirical information about the security of Top-Level Domains (TLDs) and of the overall 'health' of the DNS ecosystem exists. In this paper, we present security metrics for this ecosystem and measure the operational values of such metrics using three representative phishing and malware datasets. We benchmark entire TLDs against the rest of the market. We explicitly distinguish these metrics from the idea of measuring security performance, because the measured values are driven by multiple factors, not just by the performance of the particular market player. We consider two types of security metrics: occurrence of abuse and persistence of abuse. In conjunction, they provide a good understanding of the overall health of a TLD. We demonstrate that attackers abuse a variety of free services with good reputation, affecting not only the reputation of those services, but of entire TLDs. We find that, when normalized by size, old TLDs like .com host more bad content than new generic TLDs. We propose a statistical regression model to analyze how the different properties of TLD intermediaries relate to abuse counts. We find that next to TLD size, abuse is positively associated with domain pricing (i.e. registries who provide free domain registrations witness more abuse). Last but not least, we observe a negative relation between the DNSSEC deployment rate and the count of phishing domains.

Hidden behind domain names, there are lucrative (and ingenious) business models that misuse/abuse the DNS namespace and employ a diversified form of monetization. To curb some of those abuses, many research works have been proposed. However, while having a clear contribution and advancing the state-of-the-art, these works are constrained by their limited datasets and none of them present a survey on the forms of DNS abuse. In this paper, we address these limitations by presenting a case study in one top-level domain (TLD) operator (.nl) with diverse longitudinal datasets.We then cover eight business models that DNS abusers employ and their respective monetization form, and discuss how TLD operators can employ these datasets to detect these forms of abuse.

We present nDEWS, a Hadoop-based automatic early warning system of malicious domains for domain name registry operators, such as top-level domain (TLD) registries. By monitoring an entire DNS zone, nDEWS is able to single out newly added suspicious domains by analyzing both domain registration and global DNS lookup patterns of a TLD. nDEWS is capable to detect several types of domain abuse, such as malware, phishing, and allegedly fraudulent web shops. To act on this data, we have established a pilot study with two major .nl registrars, and provide them with daily feeds of their respective suspicious domains. Moreover, nDEWS can also be implemented by other TLD operators/registries.

We present ENTRADA, a high-performance data streaming warehouse that enables researchers and operators to analyze vast amounts of network traffic and measurement data within interactive response times (seconds to few minutes), even in a small computer cluster. ENTRADA delivers such performance by employing a optimized file format and a high-performance query engine, both open-source. ENTRADA has been operational for more than 1.5 years, having ingested more than 100 TB of pcap files from two .nl DNS authoritative servers. As we discuss, we use this data in projects that aim at further increasing the security and stability of the .nl zone. We present in this paper our design choices, experiences, and a performance evaluation of ENTRADA. Finally, we open-source ENTRADA, which can be used “out-of-the-box” by researchers, operators, and registries to deploy their own networking analysis clusters for DNS traffic, and can be easily extended to handle any other structured data.

This paper demonstrates the advantages of using structured multimedia documents for session management and media distribution in ubiquitous environments. We show how document manipulations can be used to perform powerful operations such as content to context adaptation and presentation continuity. When consuming media in ubiquitous environments, where the set of devices surrounding a user may change, dynamic media adaptation and session transfer become primary requirements. This paper presents a working system, based on a representative scenario, in which multimedia content is distributed and adapted to a movable user to best suit his/her contextual situation. The implemented scenario includes the following scenes: content selection using a personal mobile phone, content distribution to the most suitable device according to the user's context, and presentation continuity when the user moves to another location. This paper introduces the underlying document manipulations that turn the scenario into a working system.

We introduce a scalable application-level QoS adaptation service for roaming between wireless networks that are based on different technologies ('inter-tech' roaming). The service is part of a platform that supports the distribution of multimedia streams (e.g., a streamed TV channel) to mobile clients operating in a heterogeneous environment. Central to our approach is the notion of a service class, which is a domain-specific perceptual QoS level. Each domain in a wireless infrastructure must support a limited number of these service classes. Our adaptation service handles inter-tech roaming by handing a client off from one service class to another. We focus on the design of the adaptation service's client-side components. They combine the loss characteristics of the client's network interfaces with configurable policies to decide when to initiate a handoff to a target service class and when to complete it. We conclude with some experimental results.