Understanding the Stealthy BGP Hijacking Risk in the ROV Era

First empirical and analytical study of stealthy BGP hijacking under partial ROV deployment, introducing the SHAMAN framework for Internet-scale risk assessment

Yihao Chen; Qi Li; Ke Xu; Zhuotao Liu; Jianping Wu· 2026· DOI 10.48550/arXiv.2606.23071

The core problem

The Border Gateway Protocol (BGP) is the de facto inter-domain routing protocol, but it lacks built-in security mechanisms to verify the legitimacy of routing announcements. Route Origin Validation (ROV) has been proposed and partially deployed to mitigate BGP hijacking by validating the origin AS of a route against Resource Public Key Infrastructure (RPKI) records. However, partial deployment of ROV introduces an unexpected and stealthy threat: **stealthy BGP hijacking**. In this attack, malicious routes divert traffic without reaching the victim's network, thereby evading detection and alerting mechanisms. Despite its potential severity, stealthy BGP hijacking remains largely unexplored, with no documented real-world incidents or systematic characterization. This paper bridges this gap by formalizing the attack, conducting the first empirical study to track and profile such incidents in the wild, and developing an analytical framework to assess the risk at Internet scale. The authors aim to answer: How prevalent is stealthy BGP hijacking? What factors contribute to its success? And how can we quantify the risk under current ROV deployment?

The empirical study uncovered real-world instances of stealthy BGP hijacking, leading to a curated incident dataset. The long-term monitoring service provided continuous tracking, revealing that such attacks do occur in practice. The analytical assessment using SHAMAN, based on 8.3 billion generated routes under real-world ROV deployment, yielded significant findings: - **Overall success probability**: 14.1% of all possible stealthy hijack attempts would succeed in diverting traffic without alerting the victim. - **Targeted attacks**: In specific cases, the success probability can reach 99.5%, indicating that certain victim-target-hijacker combinations are highly vulnerable. - **Validation**: The analytical results were validated against the real-world dataset, achieving up to 95.9% incident-level accuracy, demonstrating the fidelity of the model. These results highlight that partial ROV deployment not only fails to eliminate BGP hijacking but also creates a new class of stealthy attacks that are harder to detect. The high success rate for targeted attacks underscores the need for more comprehensive ROV deployment and additional detection mechanisms.

The Border Gateway Protocol (BGP) is the de facto inter-domain routing protocol, but it lacks built-in security mechanisms to verify the legitimacy of routing announcements. Route Origin Validation (ROV) has been proposed and partially deployed to mitigate BGP hijacking by validating the origin AS of a route against Resource Public Key Infrastructure (RPKI) records. However, partial deployment of ROV introduces an unexpected and stealthy threat: **stealthy BGP hijacking**. In this attack, malicious routes divert traffic without reaching the victim's network, thereby evading detection and alerting mechanisms. Despite its potential severity, stealthy BGP hijacking remains largely unexplored, with no documented real-world incidents or systematic characterization. This paper bridges this gap by formalizing the attack, conducting the first empirical study to track and profile such incidents in the wild, and developing an analytical framework to assess the risk at Internet scale. The authors aim to answer: How prevalent is stealthy BGP hijacking? What factors contribute to its success? And how can we quantify the risk under current ROV deployment?

The authors employ a two-pronged approach: empirical measurement and analytical modeling. First, they formalize stealthy BGP hijacking and propose heuristics to discover potential instances by analyzing discrepancies in routing tables. They collect and curate a real-world incident dataset and deploy a long-term monitoring service to track such events. Second, to exhaustively assess the risk, they develop **SHAMAN** (Stealthy Hijacking Assessment and Modeling ANalysis), a BGP route inference framework. SHAMAN addresses three key challenges: (1) accurate ROV deployment data, (2) complete Internet-wide routes, and (3) tailored analytical models. It consolidates multiple sources to construct an accurate view of ROV deployment, infers complete Internet-wide routes using a highly efficient matrix-based approach, and facilitates statistical risk analysis via a **"victim-target-hijacker" 3-tuple model**. The matrix-based inference reduces the time for generating Internet-scale routes from over three months to just 5.22 hours, enabling systematic risk assessment across 8.3 billion generated routes under real-world ROV deployment. The 3-tuple model captures the relationships between the victim (the legitimate origin), the target (the prefix being hijacked), and the hijacker (the malicious AS), allowing for probabilistic analysis of attack success.

The findings reveal a critical security gap in the current Internet routing infrastructure. Stealthy BGP hijacking exploits the inconsistent deployment of ROV: attackers can announce routes that are not validated by ROV but still propagate because not all networks enforce validation. The victim remains unaware because traffic is diverted before reaching its network, and no alerts are triggered. The authors' 3-tuple model provides a systematic way to assess risk, and SHAMAN's efficiency enables continuous monitoring and what-if analysis. The paper discusses potential mitigations, including accelerating ROV deployment, implementing additional detection mechanisms (e.g., route leak detection, anomaly detection), and fostering international cooperation. The limitations include the reliance on inferred ROV deployment data and the dynamic nature of BGP. Future work could extend the model to incorporate temporal dynamics and more granular routing policies. Overall, this study provides a foundation for understanding and mitigating stealthy BGP hijacking, emphasizing that partial security deployment can sometimes worsen the threat landscape.

CS practitioners and researchers

Opening member content…