Source-linked AI summary
BGPay: An Incentive-Compatible Mechanism for BGP Hijack Filtering
Tomasz Sadowy, Constantine Doumanidis, Maria Apostolaki
TL;DR
BGP hijacking defenses face an incentive gap because filtering networks incur costs while prefix owners capture the main benefit. BGPay addresses this with standing bounties and commit-reveal escrow grounded in public route-monitor evidence. Across real hijack incidents, the paper finds sufficient visibility where filtering has the greatest containment impact.
Problem
BGP hijacking persists while filtering ASes bear operational and revenue costs without directly benefiting from protecting other networks’ prefixes.
Method
BGPay uses standing prefix-owner bounties, commit-reveal escrow, public monitor evidence, and containment-impact-based reward weighting.
Results
648 monitors can attest to critical provider ASes’ filtering in the mean case, and at least one monitor detects fraudulent claims in 97% of longer-prefix hijack cases.
Takeaways & Limitations
Today’s route monitoring infrastructure appears sufficient to support incentive-aligned BGP hijack filtering where containment matters most.
Takeaways & Limitations
Proxy-set size correlates strongly with containment impact for longer-prefix hijacks but only moderately for same-length hijacks, where linear rewards can misprice filterers.
Abstract
from arXiv · showhide
BGP hijacking remains a persistent threat as existing defenses, including RPKI/ROV suffer from a fundamental incentive misalignment: the networks best positioned to filter malicious announcements bear operational costs but receive no direct benefit, while the victim prefix owner captures all the value. We advocate a market-based alternative in which prefix owners post standing bounties for filtering invalid announcements of their prefixes, turning filtering from altruism into a private transaction. Our insight is that neither a propagating hijack nor its absence can hide from public route collectors, whose committed routing tables could become an independent root of trust for releasing funds of the bounty. We build on this insight to design BGPay, an escrow protocol in which filterers and monitors commit before either reveals, and a smart contract pays out on evidence rather than on the prefix owner's judgment. Analyzing 1K real hijack incidents, we find that today's collectors already provide enough visibility where it matters: ASes that are more important for containing the hijack are also highly visible from the public monitors. Hence, setting rewards proportionately to containment impact discourages misbehavior.
1 Introduction
BGP hijacking persists because voluntary filtering imposes costs on filtering ASes while primarily benefiting prefix owners. BGPay addresses this incentive mismatch with standing bounties, public-monitor evidence, and impact-weighted rewards.
- The problem: BGP hijacking remains a persistent security problem despite technical defenses such as RPKI and ROV.RPKI/ROV deployment remains limited and uneven across regions and network tiers.
- The incentive mismatch: Filtering ASes bear configuration, monitoring, misconfiguration, and forgone-revenue costs while protecting other networks’ prefixes.This creates an externality that helps explain slow voluntary adoption.
- BGPay: BGPay turns filtering into a paid service by having prefix owners post standing bounties proportional to each filterer’s containment importance.The design seeks to align filtering ASes’ incentives with prefix owners’ interests.
- Evidence: Public route collectors can provide evidence because both propagated and absent hijack paths are constrained by ordinary AS export behavior.BGPay uses this visibility to assess whether a claimant likely propagated the hijack while claiming a bounty.
- Evaluation: 648 monitors can attest to provider ASes’ filtering in the mean case, while at least one monitor witnesses fraudulent claims in 97% of longer-prefix hijack cases.These are the reported results for ASes where filtering is most critical to containment.
- Evaluation: The findings suggest BGPay can be effectively deployed with today’s route monitoring infrastructure.The conclusion is limited to the visibility demonstrated in the evaluated setting.
2 Motivation
The motivation is that filtering can be costly and privately unrewarded even when it protects a victim prefix. BGPay supplies standing bounties and a commit-reveal evidence process to support payment without mutual trust.
- The problem with filtering: Filtering requires current authorization knowledge, risks blackholing legitimate traffic, and can forgo traffic-carrying revenue.The toy example makes these operational and economic costs concrete for neighboring ASes.
- The problem with filtering: Because the benefit accrues to the victim prefix owner, neighboring ASes may rationally choose not to filter despite helping contain the hijack.The example frames filtering as an uncompensated action with benefits externalized to AS V.
- BGPay’s incentive: A participating prefix owner posts a blockchain bounty that pays ASes helping prevent a hijack.The standing payment is intended to provide a concrete reason for ASes to install filters before an attack occurs.
- Commit-reveal process: Filterers submit masked claims before revealing them, while monitors commit hashed RIB views and later publish relevant subsets.The protocol reduces copying, blockchain load, processing pressure, and full-RIB privacy exposure.
- Evidence and escrow: BGPay uses public BGP monitors to independently attest whether filtering claims are supported by observed routing behavior.This avoids relying solely on trust between the prefix owner and filtering AS.
- Residual risk: Bounties can specify exclusion lists, reward weighting, and custom payment policies, pricing rather than eliminating residual false-positive and false-negative risk.Repeated suspicious claims can also become visible on the blockchain and be excluded from future bounties.
3 Protocol Design
BGPay uses bounty setters, filtering ASes, and monitors in a phased protocol that commits and reveals claims and routing evidence. A smart contract then distributes rewards using public evidence and predefined policy.
- Participants: Bounty setters, filtering ASes, and monitors respectively fund rewards, filter invalid announcements, and publish routing-table evidence.
- Protocol messages: Bounty contracts encode prefix ownership, eligibility restrictions, escrowed balances, and the release function governing reward distribution.
- Execution phases: Filtering ASes commit masked claims before revealing them, while monitors commit routing tables and later provide evidence for evaluation.
- Execution phases: BGPay separates claim commitment from disclosure so claimants cannot copy claims after seeing others’ information.
- Protocol properties: Smart-contract execution provides trustless distribution, tamper-resistant monitor evidence, public visibility, and configurable incentives for honest filtering.
4 Claim Evaluation
The release function validates claims against structural, identity, prefix, deny-list, and protocol-timing requirements before determining eligibility from submitted evidence.
- Claim validation: The release function validates claim structure, protocol phase bounds, claimant identity, prefix matching, and deny-list eligibility.
- Claim validation: A valid maskedClaim and claim pair must come from the same eligible filtering AS, and the claimant AS must appear in the claim AS_PATH.
- Claim validation: Claims submitted outside calculated commit and reveal phase bounds are discarded.
5 Reward Distribution
BGPay estimates each filtering AS’s containment contribution through a counterfactual Maximum Damage Potential and an observable proxy-set approximation, then uses that estimate for rewards.
- Maximum Damage Potential: Maximum Damage Potential MDP(a,h) measures ASes that would observe hijack h if claimant a alone propagated it instead of filtering.
- Maximum Damage Potential: The counterfactual forwards the hijack along the preferred path to a, after which a follows normal BGP export policies.
- Reward distribution: Rewards are distributed according to each claimant’s estimated contribution to hijack containment rather than treating all filtering ASes equally.
- Proxy-set approximation: BGPay’s proxy set P(a,h) contains monitors expected to observe h if claimant a propagated it, approximating MDP(a,h) from routing-table paths.
- Proxy-set approximation: Simulations of real-world hijack incidents find a strong correlation between proxy-set size and MDP, supporting proxy sets as a useful approximation.
6 Evaluation
BGPay evaluation uses Internet-scale BGP simulations to test fraudulent-claim detection, containment-proportional rewards, and deployment incentives. It finds that monitor visibility supports robust detection and that proxy-based rewards largely track ideal containment contribution, while rewards concentrate among high-cone ASes and adoption eventually reduces hijack visibility.
- 6.1 Experimental Setup: BGPay evaluations simulate announcement propagation under different routing and filtering scenarios using 1,018 hijacker ASes from 7,988 real prefix-hijack events.The simulations use the Gao-Rexford model, CAIDA AS relationships, and stable routing states.
- 6.2 Detecting Fraudulent Claims: BGPay identifies fraudulent claims more effectively for longer-prefix than same-length hijacks because longer prefixes receive greater visibility.Detection varies by the impostor’s relationship to the hijacker.
- 6.2 Detecting Fraudulent Claims: Provider and provider-of-provider impostors receive substantial reward shares and are also the most likely to be detected, aligning fraud incentives with detection.Their large customer cones and upstream propagation make them both consequential and observable.
- 6.2 Detecting Fraudulent Claims: Fraudulent claims by providers and provider-providers are observed by highly redundant monitor sets, whereas customer-related claims are often unobserved.Peers and provider-peers are caught at moderate rates; customer relationships are hardest to detect because their customer cones are small or nonexistent.
- 6.3 Estimating Filtering Contribution: Proxy-set size correlates with Maximum Damage Potential at r = 0.893 for longer-prefix hijacks and r = 0.565 for same-length hijacks.This supports using observable proxy sets to approximate containment contribution.
- 6.3 Estimating Filtering Contribution: Mean allocation overlap is 78.4% for longer-prefix and 70.9% for same-length hijacks, preserving most ideal containment-proportionate allocation.Same-length cases under-allocate the largest contributors and over-allocate the smallest, while longer-prefix deviations lack a consistent direction.
- 6.4 Honest Participant Incentives: Containment-proportionate rewards are concentrated: 90% goes to 4.5% of filtering ASes for longer-prefix and 5.5% for same-length hijacks.The top 1% by customer-cone size earn 1.8x more than the next 9% for longer-prefix hijacks and 3.2x more for same-length hijacks.
- 6.5 Deployment Dynamics: Beyond 5–25% new-filterer adoption, reduced hijack visibility produces fewer average bounty claimants.Early adoption instead increases average claimants as more ASes become eligible for rewards.
7 Related Work
Prior BGP defenses focus on preventing, detecting, or mitigating hijacks, but do not directly solve ASes’ incentive to deploy and exercise filtering. BGPay instead uses blockchain coordination, bounty payments, and independent route monitors to corroborate filtering claims.
- Existing defenses span prevention, detection, and mitigation, including RPKI/ROV, data-plane measurement, hybrid monitoring, prefix disaggregation, and announcement outsourcing.
- As more filtering ASes join the protocol, hijack propagation and the average number of claimant ASes per hijack decrease.
- BGPay addresses the unserved incentive problem by rewarding ASes for filtering rather than relying on voluntary deployment.
- Independent route monitors corroborate filtering claims while blockchain serves as BGPay’s coordination layer.
8 Discussion & Future Work
The discussion examines strategic abuse, bounty-market design, reward concentration, proxy accuracy, and monitor participation. It identifies collusion resistance, equilibrium pricing, improved estimators, and monitor incentives as open issues.
- Strategic collisions: BGPay’s public claims constrain fabricated hijacks by exposing alleged originators and forwarding paths to potentially contradicting ASes.
- Strategic collisions: Repeated uncorroborated hijacker-filterer pairs become permanently visible, limiting how often colluding participants can exploit the mechanism.
- From incentives to equilibrium: BGPay does not determine the bounty required to induce participation, leaving heterogeneous filtering costs and market equilibrium for future work.
- From incentives to equilibrium: Containment value and corresponding rewards are highly concentrated among a relatively small number of topologically influential ASes.
- Reward estimation and monitors: Proxy-set size strongly approximates containment impact for longer-prefix hijacks but correlates only moderately for same-length hijacks.
9 Conclusion
The paper argues that BGP hijacking persists because independently managed ASes lack incentives to filter, not because technical solutions are absent. BGPay turns filtering into a paid service using public routing observations and commit-reveal escrow.
- BGP hijacking persists because independently managed ASes lack incentives to filter despite available technical solutions.
- BGPay converts hijack filtering from an uncompensated public good into a paid service.
- BGPay combines public routing observations with commit-reveal escrow to reward ASes according to their contribution to hijack containment without requiring trust between participants.
- The evaluation suggests that existing monitoring infrastructure provides sufficient visibility where filtering matters most.
A Power-Rule Payment Allocation
The power-rule allocation replaces linear proxy weighting with an exponent chosen to approximate compressed MDP-based targets. Lower α improves allocation overlap, while the resulting directional error favors lower-impact claimants.
- Payment targets: The linear rule pays claimants proportionally to proxy-set size |P(a,h)| as an approximation of allocation proportional to true MDP(a,h).
- Payment targets: For α < 1, the target proportional to MDP(a,h)^α compresses differences between high- and low-impact claimants.
- Fitting the exponent: The power rule replaces |P(a,h)| with |P(a,h)|^β and fits β_α to approximate the corresponding MDP-based target shares.
- Fitting the exponent: The exponent is fitted by minimizing distance between proxy-based and MDP-based shares on a 70% calibration subset of sampled hijack events.
- Zero-proxy claimants: 95% of zero-proxy claimants have MDP below 99.0 for longer-prefix hijacks and below 9.0 for same-prefix hijacks.
- Evaluation: As α decreases, the power rule achieves progressively higher mean allocation overlap with compressed MDP-based targets.
- Evaluation: Across power-rule settings, the highest-impact quartile is underpaid and the lowest-impact quartile is overpaid relative to MDP-based targets.
- Evaluation: Proxy-based overpayment of low-impact filterers may provide additional incentive for ASes that would otherwise contribute little to filtering.