Detecting and Characterizing DDoS Scrubbing from Global BGP Routing: Insights from Five Leading Scrubbers#

Shyam Krishna Khadka, University of Twente

• Why: Helps solve a practical monitoring problem: BGP path changes caused by DDoS scrubbing look like hijacks or leaks in your alerting, and 48% of scrubber-originated prefixes aren't properly covered by ROAs.
• What: A PAM 2026 paper detecting scrubbing activations/deactivations purely from public RIS BGP data (30 days, five scrubbers: Cloudflare, Akamai Prolexic, Vercara, Imperva, Radware). Always-on protection dominates (11k prefixes vs 5.6k on-demand); on-demand scrubbing splits into upstream-change (dominant) and origin-change modes.
• How: Inference requires at least two route-collector peers observing the AS-path change; characterization covers protection modes, session durations (median ~10h45m; 25% under 1h45m), and RPKI/IRR practice — finding 12.5% Invalid and 35.5% NotFound among temporarily-originated prefixes.
• Where applicable: BGP monitoring/anomaly-detection toolbuilders, and scrubbing customers who should fix their ROA coverage before an attack makes their scrubber originate their prefixes.