Detecting Compromised Routers via Packet Forwarding Behavior

Transcription

1 MIZRAK LAYOUT 2/14/08 4:11 PM Page 2 Detecting Compomised Routes via Packet Fowading Behavio Alpe T. Mizak, VMwae Stefan Savage and Keith Mazullo, UCSD Abstact While it is widely undestood that ciminal misceants ae subveting lage numbes of Intenet-connected computes (e.g., fo bots, spywae, SPAM fowading), it is less well appeciated that Intenet outes ae also being actively tageted and compomised. Indeed, due to its cental ole in end-to-end communication, a compomised oute can be leveaged to empowe a wide ange of diect attacks including eavesdopping, man-in-the-middle subtefuge, and denial of sevice. In esponse, a ange of specialized anomaly detection potocols has been poposed to detect misbehaving packet fowading between outes. This aticle povides a geneal famewok fo undestanding the design space of this wok and eviews the capabilities of vaious detection potocols. I t is widely undestood that the Intenet is awash in theats. The mean time fo a vulneable system to be infiltated once connected to the Intenet is typically measued in minutes. Consequently, most eseach effot in netwok secuity has focused on potecting these end systems o mitigating the impact of thei compomise. Howeve, the Intenet achitectue elies equally stongly on the coect behavio of the intemediate outes that fowad packets, hop by hop, to thei eventual destination. While it is not as widely appeciated, these netwok outes ae also unde attack. Fo example, at the 2005 Black Hat Biefings, Mike Lynn demonstated how Cisco outes can be compomised via simple softwae vulneabilities. Even simple, othes have documented how combinations of social engineeing and weak passwods can and have been used to compomise thousands of Intenet outes, and thee is an undegound maket fo tading access to them [1 4]. Finally, in thei annual suveys of the Intenet netwok secuity opeations community, Abo Netwoks Inc. have epeatedly documented such attacks acoss a ange of Intenet sevice povides (ISPs) [5]. Once a oute has been compomised, the standad command line inteface fom vendos such as Cisco and Junipe can be used to selectively dop packets, delay them o tanspaently tunnel though abitay-thid paty hosts and back again [6, 7]. Togethe these capabilities ae sufficient to selectively eavesdop, deny o degade sevice, o constuct a manin-the-middle attack against any host that eceives sevice though the oute. Thus, a numbe of eseaches have ecently exploed the poblem of detecting such oute compomises as evealed fom thei inconsistent packet fowading behavio. In this aticle we povide a geneal famewok fo undestanding this wok and then study some of the detection potocols [8 11]. This mateial is based upon his dissetation eseach at UCSD. Centalized Failue Detecto via Active Replication The expected behavio of a oute is pedictable: taffic entes a oute and is fowaded on to the next hop towad its destination. Thus, the behavio of a oute can be veified by a failue detecto via an identical eplica of that oute. 1 Fo example, in Fig. 1, a failue detecto is implemented with an identical eplica of the oute. In this scheme the failue detecto obseves oute s input taffic and delives an identical steam of packets to oute. In tun, the failue detecto veifies that the output taffic exiting oute is identical to that leaving oute. If thee is a discepancy, an alam is aised indicating that eithe the monitoed oute is faulty o the failue detecto is faulty. This is an ideal failue detecto fo evealing any anomalous fowading behavios. Howeve, this appoach has a numbe of pactical limitations that make it infeasible to deploy at scale. Complexity of Implementation Fist of all, maintaining state consistency between a oute and its eplica can be highly demanding to enginee. Fo example, a oute will eceive outing updates that cause its fowading tables to be ecomputed. If these fowading tables ae not updated at the same moment on both the oute and its eplica, a tempoay taffic fowading inconsistency may occu. Similaly, a numbe of active queue management schemes make use of andomization to dive thei opeation. Thus, to faithfully eplicate a oute s behavio also equies eplicating its andom numbe steam. 1 This scheme is also called maste-checke, active eplication, o state machine appoach in the liteatue /08/$ IEEE IEEE Netwok Mach/Apil 2008

2 MIZRAK LAYOUT 2/14/08 4:11 PM Page 3 Figue 1. Failue detecto via the active eplica/state machine appoach. Resouce Requiement Futhemoe, to implement a eplica-based failue detecto, as in Fig. 1, equies additional hadwae esouces an identical eplica of each oute and additional communication channels the passive monitos on each oute s input and output links. These can be pohibitively expensive. Reseaches have tied to addess these issues in two ways. Fist, they have developed weake but lighteweight failue detectos via taffic validation: instead of validating the exact taffic that tansits a oute, vaious chaacteistics of the taffic enteing and leaving vaious pats of the netwok can be used fo validation. Second, they have developed distibuted failue detectos that exploit the paticipation of coect outes athe than equiing a sepaate monitoing infastuctue. We fame each of these appoaches in tun below. Taffic Validation Taffic validation is the basis fo detecting anomalous behavio: given taffic enteing a egion of the netwok, and knowing the expected behavio of the outes in the netwok, anomalous behavio is detected when the monitoed taffic leaving that pat of the netwok diffes significantly fom what is expected. Taffic validation can be defined in tems of consevation of taffic. Consevation of Taffic Some popety of the taffic enteing a egion of a netwok must be consistent with the same popety of the taffic leaving that pat of a netwok. Thee ae thee design decisions that must be addessed to implement such a mechanism. Which Popety of the Taffic Is to Be Validated? Upon eceiving a packet, a oute efeences its outing table to detemine the next hop towad the destination, and then fowads the packet. Thus, ideally, the taffic enteing a oute is equal to the taffic leaving that oute. Of couse, packets expeience queuing and pocessing delay, and packets can be lost due to congestion. The most pecise desciption of taffic is itself the exact content of the packets. Howeve, the stoage equiements to buffe all packets (as well as the bandwidth consumed by esending them to implement distibuted detection, discussed late) make this appoach impactical. Instead, one can validate moe concise popeties that appoximate this ideal. Some such popeties ae: Consevation of flow validates the volume of the taffic, theeby detecting maliciously dopped packets. Consevation of content validates the content of the taffic, theeby detecting maliciously modified packets. Consevation of ode validates the ode among the packets that constitute the taffic, theeby detecting maliciously eodeed packets. Consevation of timeliness validates the time behavio of the fowading pocess, theeby detecting maliciously delayed packets. What Taffic Is to Be Monitoed? The potocols can be categoized in vaious ways. Some potocols monito a single packet, while othes monito aggegate taffic. Some potocols ae based on active pobing: they send pobe packets peiodically, while othes deploy a passive appoach that simply monitos existing taffic. What Region of a Netwok Is to Be Monitoed? Vaious existing potocols apply consevation of taffic at diffeent ganulaities in a netwok, including pe inteface, pe oute and pe path segment. A failue detecto based on taffic validation can be almost as effective as one based on active eplication, but thei educed ovehead makes them fa moe pactical. Thus, all the detection potocols examined in this aticle ae based on taffic validation, each epesenting a slightly diffeent point in the design space. In pactice, designing a taffic validation mechanism includes engineeing tade-offs fo each design decision above. Fo example, eal netwoks occasionally lose packets due to congestion; thus, a taffic validation mechanism must distinguish between benign congestive loss and packet losses caused by malicious actions. Distibuted Detection Instead of a centalized failue detecto, as in Fig. 1, most systems appoximate this sevice via a distibuted potocol that elies on the paticipation of uncompomised outes. Undelying this appoach is the obsevation that while a compomised oute can fowad taffic any way it wishes, othe outes have an expectation of how taffic should be fowaded. Thus, as long as taffic taveses neighboing uncompomised outes as well, thee will be sufficient obsevations to detect anomalous behavio. Taffic validation systems implement such a distibuted failue detecto by synchonizing taffic infomation between two o moe outes and then edistibuting this infomation to allow fo detection. Refining this model, a compomised oute can be taffic faulty by fowading taffic in a faulty manne, as well as detection potocol faulty by behaving abitaily with espect to the detection potocol. Both cases should be consideed. Also, moe than one oute may be compomised at a time. We assume that thee is sufficient path divesity between any two uncompomised outes such that they can communicate without tavesing a compomised oute. In a sense this assumption is pedantic, since this assumption is needed to ensue that the communication netwok is not patitioned, and it is impossible to guaantee any netwok communication acoss a patition. We also assume that a host s access oute is not compomised. This is a stong assumption, but necessay: if a host s access oute is compomised, the host is patitioned fom the est of the netwok, and thee is no outing emedy even if an IEEE Netwok Mach/Apil

3 MIZRAK LAYOUT 2/14/08 4:11 PM Page 4 T 1 in T 2 in T n in Figue 2. Failue detecto via a taffic validato pe oute. anomaly is detected. Moeove, fom the standpoint of the netwok such taffic oiginates fom a compomised oute, and theefoe cannot demonstate anomalous fowading behavio. In effect, distibuted detection potocols can only hope to detect anomalous outing between any two pais of uncompomised nodes. Thee is inheently some uncetainty in failue detection since one cannot geneally distinguish between a tue failue and a failue in the failue detecto itself (this is tue even with the idealized active eplication scheme). This abstact limitation manifests in distibuted taffic validation potocols as well. Fo example, suppose oute 1 collects taffic infomation about packets that tavese outes 1 to 2 to 3. Based on the infomation 3 collects, suppose 3 detemines that packets have been dopped between 1 and 2. Unfotunately, 3 cannot distinguish between the case of 1 lying about what packets it sent to 2 and 2 lying about what packets it eceived fom 1. Hence, thee is an inheent lack of pecision in detemining which outes ae compomised. We have failue detectos epot suspicions as path segments, whee a path segment is a sequence of consecutive outes that is a subsequence of a path. 2 Moe specifically, a failue detecto epots a path segment if it suspects a oute in that path segment isbehaving in a faulty manne. This section is a bief summay of the fomal specification pesented in [12]. We efe eades to [12] fo the deivation of the fomal specification. In shot, we cast the poblem as a failue detecto with completeness, accuacy, and pecision popeties. Completeness T 1 out T 2 out T n out 2 Fo example, if a netwok consists of the single path 1, 2, 3, 4, 2, 3 is a path segment, but 1, 3 is not because 1 and 3 ae not adjacent. Wheneve a oute fowads taffic in a faulty manne: If all coect outes eventually suspect that a path segment contains a faulty oute, a failue detecto is stong-complete. If at least one coect oute eventually suspects that a path segment contains a faulty oute, a failue detecto is weakcomplete. Accuacy A failue detecto is accuate if, wheneve a coect oute suspects a path segment, thee is at least one faulty oute in that path segment. Pecision A failue detecto also has a pecision, which is the maximum length of a path segment it suspects. To be useful, a failue detecto must be complete and accuate, and one would pefe a smalle pecision. Implementing such distibuted detection involves tade-offs among pecision, completeness, and the ovehead of monitoing and communication. Vaious detection potocols addess these design decisions in diffeent ways, as we discuss in the next section. Compaed to weak completeness, stong completeness is moe desiable since evey coect oute detects the fault. Given a weak-complete detecto, a stong-complete one can be implemented, but it may not be simple and some pecision would be lost. Fo example, conside that a souce oute s detects a link 1, 2 as faulty. Announcing this detection, the othe coect outes in the netwok have to conside the case that s is faulty as well. On the othe hand, in some cases having a weak-complete detecto is enough fo making a pope esponse. Fo example, elying on souce outing, a oute detecting a failue just computes a new oute excluding the suspected path segment. In the above example, s may only update its own outing table excluding the suspected 1, 2. Case Studies In this section we descibe existing potocols poposed to detect and mitigate attacks on the netwok data plane. We examine both the tade-offs in thei choice of taffic validation mechanisms and the paticula distibuted potocols used to disseminate this infomation. Taffic Validation Pe Route: WATCHERS The most simila appoximation to the failue detecto in Fig. 1 is WATCHERS [8], which detects and isolates faulty outes based on a distibuted netwok monitoing appoach. A faulty oute is defined as one that dops o misoutes packets, o behaves in an abitay manne with espect to the poposed potocol. A consevation of flow pinciple (CoFP) was poposed to detect faulty outes. Basically, CoFP states that the amount of taffic enteing a oute should be equal to the amount of taffic leaving that oute. The taffic validato WATCHERS implements is given in Fig. 2 as a centalized sevice. WATCHERS validates the CoFP of the aggegate taffic enteing into each oute in the netwok. If the diffeence between the volume of the taffic enteing and leaving the oute exceeds a use-defined theshold, a failue is detected and an alam is aised. This theshold is needed to avoid false positives as a esult of congestive packet losses. WATCHERS implements this failue detecto by equiing all the neighboing outes of a oute to synchonize with each othe, count how many bytes they have eceived fom and fowaded to duing an ageed-upon time inteval, distibute snapshots of thei countes to the othes by flooding, and finally, validate the CoFP. If a neighbo oute n can not validate the oute, n announces that the link n, is suspicious, and n, is 4 IEEE Netwok Mach/Apil 2008

4 MIZRAK LAYOUT 2/14/08 4:11 PM Page 5 Link ( 1, 2 ) 1 2 Link ( 2, 3 ) Figue 3. Failue detecto via a taffic validato pe path-segment nodes. emoved fom the outing fabic. In tems of ou specification, WATCHERS is accuate with a pecision of 2. It is not complete as descibed, but can be modified to be stong-complete as explained in [13]. Geneally speaking, thee ae two limitations of WATCHERS: The main dawback of WATCHERS is its estictive theat model: it can only detect malicious packet dops and misoutes. Seveal eseaches [9 11] have subsequently developed potocols with moe geneal taffic validation mechanisms addessing a moe compehensive set of attacks. The achitects of WATCHERS noticed a completeness poblem caused by consoting faulty outes, a poblem fist descibed by Pelman [14]. Faulty outes ae said to be consoting if they launch a coodinated attack and coopeate to hide each othe s malicious behavio. The WATCHERS potocol addessed this issue by equiing each oute to maintain state fo evey neighbo and destination pai in the netwok. Othe potocols have addessed this poblem with a diffeent appoach: validating taffic ove path segments. We discuss this next. Taffic Validation pe Path Segment Nodes: HSER Avamopoulos et al. [9] pesent a potocol called Highly Secue and Efficient Routing (HSER), a combination of souce outing, hop-by-hop authentication, a pioi eseved buffes, sequence numbes, timeouts, end-to-end eliability mechanisms, and fault announcements. While none of these individual mechanisms is novel by itself, it is the combination of them that delives Byzantine obustness and detection. The taffic validato HSER implements is given in Fig. 3 as a centalized sevice. HSER validates the consevation of content popety of a single packet that is monitoed along the path fom the souce to the destination. If any oute along the path discoves that its neighbo has lost o alteed the packet, a failue is detected and an alam is aised. HSER implements its failue detecto by equiing each oute along the path to compute a fingepint fo the monitoed packet, keep a timeout, and finally, validate the consevation of content popety with its neighbos. Upon eceiving a packet, the oute fist validates the authenticity and fowads the packet to the next hop towad the destination. Afte fowading the packet, the oute sets a timeout to the wost case ound-tip time to the destination fom itself. If the authenticity of the packet is not veified o the timeout expies, the oute geneates a fault announcement, including its neighbo and itself, to send back to the souce. HSER elies on souce outing to act on its findings. 3 1 Thus, upon eceiving a fault announcement, the souce oute computes a new oute to the destination excluding the detected link Link ( 3, 4 ) fom its outing fabic. In tems of ou specification, HSER is weak-complete since only the souce detects a failue and accuate with a pecision of 2. Othe potocols based on this appoach ae pesented in [12, 15, 16]. 4 Howeve, the ovehead of this appoach is quite high, since fo evey souce and destination pai, all of the outes along the path must paticipate in the detection potocol. To mitigate this ovehead, othe eseaches poposed two complementay optimizations: Give up pecision by only validating at the end outes of a path segment (i.e., a contiguous sequence of outes on the path), in which case none of the intemediate outes along the path paticipates in detection. Howeve, it also becomes impossible to isolate faults to a fine ganulaity than the length of the path segment being monitoed. Give up accuacy by geneating a sampling schedule and only sampling the chosen packets at end outes of the path segment. While this method significantly deceases ovehead, attacks on unsampled packets cannot be detected. Taffic Validation Pe Path Segment Ends: SecTace SecTace [10] was developed to be a pactical tool fo secuely tacing the path of taffic fom a souce towad a paticula destination. It poceeds hop by hop simila to taceoute: at each ound, the souce validates the taffic between itself and an intemediate oute towad the destination. The taffic validato SecTace implements is given in Fig. 4 as a centalized sevice. SecTace validates the consevation of content popety of the aggegate o sampled taffic 3 between the souce oute and an intemediate oute. If the souce detects a discepancy in the taffic, a failue is detected and an alam is aised. SecTace implements such a failue detecto distibuted in the netwok by equiing only the end outes of the monitoed path segment to synchonize with each othe and to compute fingepints fo the taffic between themselves fo an ageed-upon time inteval. At the end of a ound, the coe- 3 It can adopt both active pobing and passive monitoing appoaches. 2 2 Path segment( 2, 3) Figue 4. Failue detecto via a taffic validato pe path-segment ends IEEE Netwok Mach/Apil

5 MIZRAK LAYOUT 2/14/08 4:11 PM Page 6 T 1 in T 2 in T n in Figue 5. Failue detecto via a taffic validato pe inteface. sponding intemediate oute sends back the infomation it has collected and the identity of the next expected oute towad the destination. Upon eceiving this infomation, the souce oute validates the consevation of content popety: if the souce validates the taffic, it initiates anothe Sec- Tace ound with the next intemediate oute towad the destination; othewise, the souce detects a failue. Fo example, in Fig. 4 a path segment of 1, 2, 3, 4 is monitoed duing the given taffic validation ound, and only the souce 1 and the coesponding intemediate oute 4 implement the distibuted failue detecto. If 1 detects a discepancy in the taffic, a failue is detected and an alam is aised. Eithe one of the intemediate outes { 2, 3 } is taffic faulty, intoducing discepancy into the monitoed taffic, o the failue detecto, which is implemented by 1 and 4, is detection potocol faulty: at least one of { 1, 4 } is faulty. In tems of ou specification, SecTace is weak-complete since only the souce detects a failue and accuate with a pecision of k, whee k is the length of the monitoed path segment. Howeve, this accuacy is pedicated on the assumption that malicious actions ae consistent ove time and not Byzantine. Fo example, in Fig. 4, if 1 could not validate the taffic with 4, it would detect 3, 4 as faulty. The easoning behind this appoach is that 1 was able to validate the same taffic up to the upsteam neighbo 3 in the pevious validation ound, so eithe 3 o 4 must be faulty, intoducing taffic discepancy. Howeve, if faulty outes can modify thei behavio, this assumption violates the accuacy popety. Fo example, assume that oute 2 is faulty, but only altes taffic afte 1 completes a validation ound with 3. Consequently, 3, 4 would be identified as faulty, while both 3 and 4 ae coect. To addess this poblem, the authos popose to give occasional indications of SecTace activity, such as by continuously sending ound initialization packets petending to monito the taffic, while in eality doing nothing. Finally, they popose thee diffeent countemeasues in esponse to a detected failue: The souce ties to oute the taffic aound the detected link using souce outing. The souce notifies the downsteam outes, expecting them Q Q T n out to make the appopiate outing adjustments avoiding the suspected outes. The souce alets the administato of the suspected outes. Othe potocols based on this appoach ae pesented in [12, 17 21]. Taffic Validation pe Inteface: Potocol χ Unfotunately, it is quite challenging to attibute a missing packet to a malicious action because moden IP netwoks outinely dop packets when the load tempoaily exceeds a oute s buffeing capacity. Almost all detection potocols have tied to addess this poblem using a usedefined theshold. Unfotunately, using such a theshold will necessaily ceate unnecessay false positives o mask highly focused attacks. One exception is Potocol χ [11], which dynamically infes the numbe of congestive packet losses that will occu based on measued taffic ates and buffe sizes. Once the ambiguity fom congestion is emoved, subsequent packet losses can be attibuted to malicious actions based on one of the pevious taffic validation mechanisms. The taffic validato Potocol χ implements is given in Fig. 5 as a centalized sevice. Potocol χ validates the consevation of timeliness popety fo aggegate taffic enteing each inteface of a oute in the netwok. If a packet loss occus when the monitoed inteface s queue is not pedicted to be full, a failue is detected and an alam is aised. Potocol χ implements such a failue detecto distibuted in the netwok by equiing each neighbo of a oute to synchonize with each othe, compute a fingepint with a timestamp fo each packet that passes though the inteface Q duing an ageed-upon time inteval, distibute these infomation among the othe neighboing outes, and finally, validate the consevation of timeliness popety of the taffic by simulating the behavio of the monitoed inteface queue. If a neighbo oute n detects that oute dops a packet when the coesponding queue is not full, n announces that link n, is suspicious, and n, is emoved fom the outing fabic. In tems of ou specification, Potocol χ is stong-complete and accuate with a pecision of 2. Potocol χ can be extended to addess the poblem of adjacent consoting faulty outes by monitoing evey output intefaces of the neighbos k hops away and disseminating the taffic infomation to all neighbos within diamete hops. Howeve, this appoach can also add significant additional communications ovehead when netwoks ae densely connected (as descibed in [12]). The detection potocol in [22] is also based on this appoach. Conclusion In this aticle we have descibed a geneal famewok fo undestanding the liteatue on detecting malicious outes via packet fowading behavio. We have descibed how taffic validation is the basis fo all such schemes, and distibuted pe-oute validation is a simple appoximation to an idealized detecto. Howeve, due to the theat of consoting faulty outes (i.e., multiple outes on a path have been compomised), pactical systems ae limited to validating path segments athe than individual outes. Within this appoach thee is a tade-off between pecision and ovehead depending on the span of a segment and most potocols have chosen to exploe the lowe ovehead pat of this design space. Finally, all potocols ae subject to noise due to conges- 6 IEEE Netwok Mach/Apil 2008

6 MIZRAK LAYOUT 2/14/08 4:11 PM Page 7 tive packet loss, which is difficult to distinguish fom malicious dopping. While pe-inteface techniques can diffeentiate between these conditions, it comes at the expense of high ovehead. Fo in-depth analysis of these potocols and futhe issues, the eades ae efeed to [23]. In a shot time thee have been significant advances in this domain, and while none of these potocols has yet been deployed in a poduction netwok, they ae quickly becoming cheap enough and pecise enough to be a viable option against oute-oiented attacks. Refeences [1] R. Thomas, ISP Secuity BOF, NANOG28, June 2003, og/mtg-0306/pdf/thomas.pdf [2] X. Ao, DIMACS Repot: Wokshop on Lage Scale Intenet Attacks, Nov [3] M. Wolfgang, Exploiting Cisco Routes, Sept. 2003, [4] M. Ahaoni and W. M. Hidalgo, Cisco SNMP Configuation Attack with a GRE Tunnel, Sept. 2005, [5] D. McPheson and C. Labovitz, Woldwide Infastuctue Secuity Repot, Sept. 2006, [6] Gauis, Things to Do in Ciscoland When You e Dead, Jan. 2000, [7] D. Taylo, Using a Compomised Route to Captue Netwok Taffic, unpublished tech. ep., July [8] K. A. Badley et al., Detecting Disuptive Routes: A Distibuted Netwok Monitoing Appoach, Poc. IEEE Symp. Sec.and Pivacy, May 1998, pp [9] I. Avamopoulos et al., Highly Secue and Efficient Routing, INFOCOM 04, Amendment, Feb [10] V. N. Padmanabhan and D. R. Simon, Secue Taceoute to Detect Faulty o Malicious Routing, SIGCOMM Comp. Commun. Rev., vol. 33, no. 1, 2003, pp [11] A. T. Mizak, K. Mazullo, and S. Savage, Detecting Malicious Packet Losses, UCSD, tech. ep. CS , Ap [12] A. T. Mizak et al., Detecting and Isolating Malicious Routes, IEEE Tans. Dependable and Secue Computing, vol. 3, no. 3, July. Sept. 2006, pp [13] A. T. Mizak, K. Mazullo, and S. Savage, Detecting Malicious Routes, UCSD, tech. ep. CS , May [14] R. Pelman, Netwok Laye Potocols with Byzantine Robustness, Ph.D. dissetation, MIT LCS TR-429, Oct [15] K. Agyaki et al., Poviding Packet Obituaies, Poc. ACM SIGCOMM HotNets-III, [16] A. Hezbeg and S. Kutten, Ealy Detection of Message Fowading Faults, SIAM J. Comp., vol. 30, no. 4, 2000, pp [17] B. Awebuchet al., An On-Demand Secue Routing Potocol Resilient to Byzantine Failues, ACM Wksp. Wieless Sec., Sept [18] I. Avamopoulos and J. Rexfod, Stealth Pobing: Efficient Data-Plane Secuity fo IP Routing, Poc. USENIX Annual Tech. Conf., May June [19] S. Lee, T. Wong, and H. S. Kim, Secue Split Assignment Tajectoy Sampling: A Malicious Route Detection System, Poc. IEEE DSN 06, June 2006, pp [20] D. Wendlandt et al., Don t Secue Routing Potocols, Secue Data Delivey, Poc. 5th ACM Wksp. Hot Topics in Netwoks Nov [21] S. Goldbeg et al., Measuing Path Quality in the Pesence of Advesaies: The Role of Cyptogaphy in Netwok Accountability, Pinceton Univ., tech. ep., [22] W. Zhang et al., Secue Routing in Ad Hoc Netwoks and a Related Intusion Detection Poblem, IEEE MILCOM, [23] A. T. Mizak, Detecting Malicious Routes, Ph.D. dissetation, UCSD, Sept Biogaphies ALPER T. MIZRAK [SM] (amizak@cs.ucsd.edu) eceived a B.S. degee in compute engineeing fom Bilkent Univesity, Ankaa, Tukey, in 2000 and a Ph.D. degee in compute science fom the Univesity of Califonia, San Diego, in He is a senio membe of technical staff at VMwae. His eseach inteests ae compute netwoks and fault-toleant distibuted systems. Univesity of Califonia, San Diego whee he has been since He woks on both theoetical and pactical issues of fault-toleant distibuted computing in vaious domains, including gid computing, mobile computing, and clustes. STEFAN SAVAGE [M] eceived a B.S. degee in applied histoy fom Canegie- Mellon Univesity and a PhD degee in compute science and engineeing fom the Univesity of Washington. He is an associate pofesso of compute science and engineeing at the Univesity of Califonia, San Diego, and cuently seves as diecto of the Coopeative Cente fo Intenet Epidemiology and Defenses (CCIED), a joint poject between UCSD and the Intenational Compute Science Institute. His eseach inteests lie at the intesection of opeating systems, netwoking, and compute secuity. KEITH MARZULLO [M] eceived a Ph.D. degee fom Stanfod Univesity in He is a pofesso in the Compute Science and Engineeing Depatment at the IEEE Netwok Mach/Apil