Skip to content

Ares: Comprehensive Path Hijacking Detection via Routing Tree#

USENIX Security '25 (34th USENIX Security Symposium) digest Program Core pick 13–15 August 2025

Recording

Yinxiang Tao et al., Tsinghua University / Zhongguancun Laboratory / Quan Cheng Laboratory; Congcong Miao, Tencent — Core

Play the recording: Ares: Comprehensive Path Hijacking Detection via Routing Tree

  • Why: Path hijacking (manipulating AS-path attributes rather than just the origin) is the stealthier successor to origin hijacking specifically designed to evade existing detection — this is a system that closes that gap with real-event validation, not just simulation.
  • What: Ares, a system detecting path hijacking by tracking changes to an AS's "observed prefix routing tree" (OPRT), validated against 12 real-world hijacking events (detected within 5 minutes each) and large-scale simulation (97.2%–99.3% detection rate, 1.06% false-positive rate). (from abstract only)
  • How: Uses weighted edit distance between routing trees to quantify anomalous change, combined with clustering to accelerate detection and heuristics to reduce false positives; generates ~2.31 alerts/hour across the entire Internet. (from abstract only)
  • Where applicable: General BGP route-hijacking detection for network operators and Tier-1/content ASes; a deployable detection system rather than a protocol change.