BGP Route Hijacking Detection: Three Decades of Evidence, Methods, and Open Challenges

Source abstract

Detecting a Border Gateway Protocol (BGP) route hijack requires evidence that a route is unauthorized, that its path is implausible, or that forwarding has changed in a way consistent with traffic diversion. These are different claims, and existing detectors observe different parts of them. We review research published across the period from 1996 to October 2026, combining a documented bibliographic search with primary source examination of representative systems. We organize detection methods by their evidence: origin and path history, routing authorization, active forwarding measurements, passive traffic telemetry, and learned representations. We compare early origin change alerts and hybrid verification systems with operator controlled detection, forged origin inference, routing tree analysis, and recent graph and language based models. We distinguish hijack detection from general BGP anomaly detection, route leak detection, attacker localization, and mitigation. Our synthesis separates the probability of observing an attack from detection conditional on observation, and separates both from confidence in authorization. This separation explains why reported accuracy, alert volume, and recovery time do not provide a common ranking of detectors. We examine label provenance, temporal leakage, monitoring bias, model poisoning, and the limits of registry fusion. We conclude with a reporting protocol and research questions for evaluating detectors against partial visibility, changing operational intent, and adaptive adversaries.