Understanding the Stealthy BGP Hijacking Risk in the ROV Era
2026-06-22 • Cryptography and Security
Cryptography and SecurityNetworking and Internet Architecture
AI summaryⓘ
The authors study a trick called stealthy BGP hijacking, where bad actors secretly redirect internet traffic without letting victims know. They created ways to spot these cases by checking differences in routing tables and collected real-world examples of such attacks. To understand the problem better, they built SHAMAN, a tool that quickly analyzes internet routes and how security measures are deployed to estimate the risk of these attacks. Their results show that these sneaky hijacks are possible quite often, especially in targeted attacks, and their tool’s findings match well with real incidents.
BGPRoute Origin Validation (ROV)BGP hijackingstealthy hijackingrouting tableroute inferenceInternet routing securitynetwork monitoringrisk assessmentSHAMAN framework
Authors
Yihao Chen, Qi Li, Ke Xu, Zhuotao Liu, Jianping Wu
Abstract
The partial deployment of Route Origin Validation (ROV) poses an unexpected security threat known as stealthy BGP hijacking, i.e., a particularly elusive form of BGP hijacking where malicious routes divert traffic without reaching (and thus alerting) the victims. This risk remains largely unexplored, with neither documented real-world incidents nor systematic characterization available. To bridge this gap, we formalize stealthy BGP hijacking and propose heuristics to discover potential instances through routing table discrepancies. We conduct the first empirical study to track and profile stealthy BGP hijacking in the wild, contributing a curated real-world incident dataset and a long-term monitoring service. Inspired by the empirical insights, we further conduct an analytical study to exhaustively assess the risk. This requires accurate ROV deployment data, complete Internet-wide routes, and tailored analytical models. To address these challenges, we develop SHAMAN, a BGP route inference framework dedicated to assessing stealthy BGP hijacking risk. SHAMAN consolidates multiple sources to construct an accurate view of ROV deployment, infers complete Internet-wide routes through a highly efficient matrix-based approach, and facilitates statistical risk analysis via a "victim-target-hijacker" 3-tuple model. By reducing the time for generating Internet-scale routes from over three months to just 5.22 hours, SHAMAN enables systematic risk assessment across 8.3 billion generated routes under real-world ROV deployment. Our findings reveal a 14.1% overall success probability for stealthy BGP hijacking, with targeted attacks reaching 99.5% success in specific cases. Validation against our real-world dataset shows up to 95.9% incident-level accuracy, demonstrating the fidelity of our analytical results.