The Border Gateway Protocol (BGP) is the Internet’s most crucial protocol for efficient global connectivity and traffic routing. However, BGP is well known to be susceptible to route hijacks and leaks. Route hijacks are the intentional or unintentional illegitimate announcements of network resources that can compromise the confidentiality, integrity, and availability of communication systems. In the past, the so-called “serial hijackers” have hijacked Internet resources multiple times, some lasting for several months or years. So far, only the paper “Profiling BGP Serial Hijackers” has explicitly focused on these repeat offenders, and it dates back to 2019. Back then, they had to process large amounts of BGP announcements to find a few potential serial hijackers. In this paper, we revisit the profiling of serial hijackers. We reproduced the 2019 study and showed that we can identify potential offenders with less data while achieving similar accuracy. Our study confirms that there has been no significant increase in the evolution of serial hijacking activities in the last five years. We then extend their research, further analyze the characteristics of the serial hijackers, and show that most of the alleged serial hijackers are still active on the Internet. We also find that 22.9% of the hijacks violated RPKI objects but were still widely propagated, and that even MANRS participants were among the propagating networks.

The Border Gateway Protocol (BGP) is a crucial inter-domain routing protocol that uses update messages to enable Autonomous Systems (ASes) to share network reachability information. Typically, ASes should only trigger update messages to reflect configuration changes and link failures for optimal path selection. However, we have identified recurring patterns of highfrequency repeated updates without any topological changes, which consume unnecessary resources of the route collectors for archiving and storage, and complicate downstream analysis. Although the phenomenon of noisy BGP peers and prefixes is known, current work has not quantified its scope and characteristics. This study fills this gap and analyzes over 80 billion update messages from multiple RouteViews collectors spanning several years. We identify and characterize high-frequency repeated updates driven by a small fraction of sessions and prefixes. For instance, fewer than 2% of the prefixes accounted for over 90% of update messages in some BGP update traces.

Distributed denial-of-service (DDoS) attacks may be driven not only by economic motives such as extortion, but also by social or political goals, including hacktivism and state-sponsored operations. Therefore, the monetary value of a target alone does not fully explain why some organizations are more frequently victimized. While cloud providers deploy advanced defenses — such as Anycast routing, traffic scrubbing, and filtering — they also concentrate many potential targets within a shared infrastructure, increasing their exposure to DDoS attacks. This study aims to understand what makes organizations more suitable DDoS targets by examining two key attributes: visibility and perceived value, represented by website popularity and industry sector. We also investigate how the customer portfolio of cloud and data center providers influences the DDoS threat to their infrastructure. Research Questions: • How do organizational characteristics related to value and visibility — specifically, popularity and industry sector — correlate with the threat of DDoS attacks? • How does the diversity of customer business sectors hosted by a cloud or data center provider influence the DDoS threat to its infrastructure? Methodology: We conducted a large-scale analysis of DDoS incidents inferred from network telescope data spanning five years. We estimated target visibility and value using Alexa ranks and Cisco Umbrella content categories. We also analyzed the relationship between customer sector composition and DDoS threat at the provider level. Key Findings: • Popular websites are more frequently attacked, though this pattern weakened during the COVID-19 pandemic. • Certain industry sectors face significantly higher and repeated DDoS threats. • Cloud providers serving a higher proportion of high-risk sectors are more likely to face frequent DDoS attacks.

The Border Gateway Protocol (BGP) remains susceptible to prefix hijacks due to its trust-based nature and lack of default robust authentication mechanisms. Prefix hijacks are unintentional or malicious announcements of prefixes allocated to other ASes. Although prefix hijacks are primarily associated with misconfigurations, they remain a significant security threat. For instance, the recent hijacking and route leak incident involving Cloudflare made their DNS resolver unreachable for some networks for about 8 hours. Some ASes perform hijacks frequently and for longer duration. We revisited these “serial hijackers” in 2024 and validated some of the potential serial hijackers with external data. However, neither the original study from 2019 nor ours dug deeper to understand the impact and goal of serial hijackers. This study fills this gap and shows that$22.9 \%$of the announcements were RPKI-invalid, raising new questions about the intent of the hijack. Finally, we show that these invalid announcements still reach many networks on the Internet, demonstrating that many ASes are not doing RPKI route origin validation, thereby compromising the Internet's stability and security.

Distributed Denial of Service (DDoS) attacks provide an easy option for these criminals to disrupt the business of these online platforms. We analyse the economic impact of DDoS attacks on a crypto-currency exchange using event analysis. Our contributions are fourfold: Firstly, we develop an estimation model utilising ideas from behavioural finance to predict volume of crypto-currency traded on the basis of changes in price. Secondly, we perform an event analysis to evaluate whether there is an impact of a DDoS attack on the volume traded on the exchange in 17 different cases. Thirdly, we find that in 13 cases the negative impact due to a DDoS attack is recovered within the same day by the exchange. Finally, we evaluate hourly trade data to show why in most cases the volume traded recovers within a single day.

Botnets continue to be an active threat against firms or companies and individuals worldwide. Previous research regarding botnets has unveiled information on how the system and their stakeholders operate, but an insight on the economic structure that supports these stakeholders is lacking. The objective of this research is to analyse the business model and determine the revenue stream of a botnet owner. We also study the botnet life-cycle and determine the costs associated with it on the basis of four case studies. We conclude that building a full scale cyber army from scratch is very expensive where as acquiring a previously developed botnet requires a little cost. We find that initial setup and monthly costs were minimal compared to total revenue.

DDoS attacks are increasingly used by 'hackers' and 'hacktivists' for various purposes. A number of on-line tools are available to launch an attack of significant intensity. These attacks lead to a variety of losses at the victim's end. We analyse the impact of Distributed Denial-of-Service (DDoS) attack announcements over a period of 5 years on the stock prices of the victim firms. We propose a method for event studies that does not assume the cumulative abnormal returns to be normally distributed, instead we use the empirical distribution for testing purposes. In most cases we find no significant impact on the stock returns but in cases where a DDoS attack creates an interruption in the services provided to the customer, we find a significant negative impact.

In the next years the market for low value online content, like music and videos, is expected to grow substantially. To allow "pay-per-use" of such content, micropayment systems are expected to play an important role. Since there are already many competing micropayment systems on the market, customers and merchants are forced to use multiple systems. To overcome the problems associated with using multiple systems, the research presented in this paper builds upon the idea of payment gateways that interconnect these systems. We introduce a generally applicable interconnection method such that the interconnection of these systems can be easily realized in a systematic way. This approach consists of (de)enhancing the existing micropayment services towards a uniform service level before the interconnection takes place. This paper presents the main functional characteristics of existing payment systems, and proposes modification strategies for existing micropayment systems to provide the uniform payment service. The modifications are required before the interconnection can take place.