How the academia is innovating in Network Security?

Most of the Internet's core protocols were designed on the assumption that everyone involved is honest. BGP accepts whatever routes a neighbor announces, and DNS answers are rarely checked. Industry patches these gaps slowly. Academia has been building tools that detect problems, measure them, and sometimes fix them before the standards catch up. Here are a few I came across while studying networking at Georgia Tech.

ARTEMIS: catching your own BGP hijacks

A BGP hijack happens when a network announces IP prefixes that don't belong to it, and part of the Internet starts sending traffic there. Most detection services are run by third parties, who alert you minutes or hours later.

ARTEMIS (Sermpezis et al., FORTH and CAIDA) flips that. The network that owns the prefixes runs it. ARTEMIS compares live feeds from public BGP collectors such as RIPE RIS and RouteViews against what the operator knows its routes should look like. When it spots a hijack, it can react on its own, for example by announcing more specific prefixes so that its legitimate routes win again. In real experiments the authors neutralized hijacks within about a minute. The project is open source and used by real operators.

Blackholing: a DDoS defense, measured

Remote-triggered blackholing is a blunt defense against DDoS: the victim tags a route with a BGP community (standardized in RFC 7999) and its upstream drops all traffic to that prefix. The attack stops, and so does every legitimate request.

Research made this visible. Giotsas et al. (IMC 2017) used public BGP data to infer who blackholes, how often, and for how long. Stellar (Dietzel et al., CoNEXT 2018) went further and proposed dropping only the attack traffic at Internet exchange points, not the whole prefix.

Passive monitoring: listening to unused space

Some address space is routed but not used by anyone, so any packet that arrives there is a signal. Network telescopes like CAIDA's UCSD Network Telescope collect that traffic. The classic paper is Moore et al. (USENIX Security 2001): DDoS attacks that use spoofed source addresses make the victims reply to random IPs, and some of that "backscatter" lands in the telescope. That lets you estimate attacks across the whole Internet without seeing the victims. The same idea powers worm and scanner tracking and outage detection projects like IODA.

Active monitoring: Iris and censorship measurement

Passive data can't tell you what a user in another country sees. Active measurement sends probes and checks the answers. Iris (Pearce et al., USENIX Security 2017) measures DNS manipulation worldwide by querying open DNS resolvers. To avoid putting home users at risk, it keeps only resolvers that look like network infrastructure. It then uses consistency checks (same AS, same TLS certificate, and so on) to separate normal CDN variation from deliberate tampering. Related work like Augur and Censored Planet extends this to TCP blocking and runs it continuously.

Why this matters

None of these tools replaces protocol fixes like RPKI or DNSSEC. What they do is give us evidence: how often hijacks happen, who gets blackholed, where DNS is being manipulated. That evidence is often what convinces operators and standards bodies to act.