{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T05:03:34Z","timestamp":1773119014414,"version":"3.50.1"},"publisher-location":"Cham","reference-count":58,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032182678","type":"print"},{"value":"9783032182685","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-18268-5_2","type":"book-chapter","created":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T16:52:03Z","timestamp":1773075123000},"page":"17-43","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Detecting and\u00a0Characterizing DDoS Scrubbing from\u00a0Global BGP Routing: Insights from\u00a0Five Leading Scrubbers"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3660-6226","authenticated-orcid":false,"given":"Shyam Krishna","family":"Khadka","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6662-704X","authenticated-orcid":false,"given":"Suzan","family":"Bayhan","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9614-2377","authenticated-orcid":false,"given":"Ralph","family":"Holz","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7052-9300","authenticated-orcid":false,"given":"Cristian","family":"Hesselman","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,3,10]]},"reference":[{"key":"2_CR1","unstructured":"Akamai: Prolexic - Comprehensive DDoS Attack Protection. https:\/\/www.akamai.com\/resources\/product-brief\/prolexic. Accessed 13 Nov 2025"},{"key":"2_CR2","unstructured":"Akamai Services Descriptions | Akamai. https:\/\/www.akamai.com\/site\/en\/documents\/corporate\/akamai-services-descriptions.pdf. Accessed 13 Nov 2025"},{"key":"2_CR3","unstructured":"BGP.tools. https:\/\/bgp.tools\/"},{"key":"2_CR4","doi-asserted-by":"crossref","unstructured":"Bogon Reference HTTP. https:\/\/www.team-cymru.com\/bogon-reference-http. Accessed 10 Oct 2025","DOI":"10.1186\/s41235-025-00644-3"},{"key":"2_CR5","doi-asserted-by":"crossref","unstructured":"Bush, R.: Origin Validation Operation Based on the Resource Public Key Infrastructure (RPKI). RFC 7115 (Jan 2014). 10.17487\/RFC7115. https:\/\/www.rfc-editor.org\/info\/rfc7115","DOI":"10.17487\/rfc7115"},{"key":"2_CR6","unstructured":"CAIDA: AS Rank (March 2024). https:\/\/doi.org\/10.21986\/CAIDA.DATA.AS-RANK"},{"key":"2_CR7","doi-asserted-by":"crossref","unstructured":"Chung, T., et al.: RPKI is coming of age: A longitudinal study of RPKI deployment and invalid route origins. In: Proceedings of the Internet Measurement Conference, pp. 406\u2013419 (2019)","DOI":"10.1145\/3355369.3355596"},{"key":"2_CR8","unstructured":"Cloudflare Docs: About | cloudflare network interconnect docs (2024). https:\/\/developers.cloudflare.com\/network-interconnect\/about\/"},{"key":"2_CR9","unstructured":"Cloudflare Magic Transit Docs: Advertise prefixes (2024). https:\/\/developers.cloudflare.com\/magic-transit\/how-to\/advertise-prefixes\/. Accessed 14 Nov 2025"},{"key":"2_CR10","unstructured":"Cloudflare Radar: AS32787 overview (2024). https:\/\/radar.cloudflare.com\/as32787"},{"key":"2_CR11","unstructured":"Flow-based monitoring for Magic Transit. https:\/\/blog.cloudflare.com\/flow-based-monitoring-for-magic-transit\/. Accessed 19 Nov 2025"},{"key":"2_CR12","unstructured":"Hyper-volumetric DDoS attacks skyrocket: Cloudflare\u2019s 2025 Q2 DDoS threat report. https:\/\/blog.cloudflare.com\/ddos-threat-report-for-2025-q2\/. Accessed 28 Sept 2025"},{"key":"2_CR13","unstructured":"Get started $$\\cdot $$ Cloudflare BYOIP docs. https:\/\/developers.cloudflare.com\/byoip\/get-started\/. Accessed 10 Oct 2025"},{"key":"2_CR14","unstructured":"BGP zombies and excessive path hunting. https:\/\/blog.cloudflare.com\/going-bgp-zombie-hunting\/. Accessed 20 Nov 2025"},{"key":"2_CR15","unstructured":"Magic Transit Reference Architecture. https:\/\/developers.cloudflare.com\/reference-architecture\/architectures\/magic-transit\/. Accessed 20 Nov 2025"},{"key":"2_CR16","unstructured":"RPKI and Cloud DDoS Protection - Corero Network Security. https:\/\/www.corero.com\/rpki-and-cloud-ddos-protection\/. Accessed 14 Oct 2025"},{"key":"2_CR17","doi-asserted-by":"crossref","unstructured":"Darwich, O., Pelsser, C., Vermeulen, K.: Detecting traffic engineering from public BGP data. In: International Conference on Passive and Active Network Measurement, pp. 307\u2013334. Springer (2025)","DOI":"10.1007\/978-3-031-85960-1_13"},{"key":"2_CR18","unstructured":"DDoS providers. https:\/\/x.com\/eastdakota\/status\/1937828176056521011\/photo\/1. Accessed 10 Sept 2025"},{"key":"2_CR19","doi-asserted-by":"crossref","unstructured":"Du, B., et al.: Irregularities in the internet routing registry. In: Proceedings of the 2023 ACM on Internet Measurement Conference, pp. 104\u2013110 (2023)","DOI":"10.1145\/3618257.3624843"},{"key":"2_CR20","doi-asserted-by":"publisher","unstructured":"Gilad, Y., Goldberg, S., Sriram, K., Snijders, J., Maddison, B.: The Use of maxLength in the Resource Public Key Infrastructure (RPKI). RFC 9319 (Oct 2022). https:\/\/doi.org\/10.17487\/RFC9319, https:\/\/www.rfc-editor.org\/info\/rfc9319","DOI":"10.17487\/RFC9319"},{"key":"2_CR21","unstructured":"GitHub Survived the Biggest DDoS Attack Ever Recorded. https:\/\/www.wired.com\/story\/github-ddos-memcached\/. Accessed 14 Oct 2025"},{"key":"2_CR22","unstructured":"Global Routing Intelligence Platform. https:\/\/grip.inetintel.cc.gatech.edu\/. Accessed 17 Sept 2025"},{"key":"2_CR23","unstructured":"Holmes, D.: The forrester wave\u2122: DDoS mitigation solutions, q1 2021 (2021). https:\/\/allofsecurity.pl\/wp-content\/uploads\/2021\/03\/The-Forrester-Wave-DDoS-Mitigation-Solutions-Q1-2021.pdf. Accessed 14 Jan 2025"},{"key":"2_CR24","doi-asserted-by":"publisher","unstructured":"Huston, G., Michaelson, G.: Validation of Route Origination Using the Resource Certificate Public Key Infrastructure (PKI) and Route Origin Authorizations (ROAs). RFC 6483 (Feb 2012). https:\/\/doi.org\/10.17487\/RFC6483, https:\/\/www.rfc-editor.org\/info\/rfc6483","DOI":"10.17487\/RFC6483"},{"key":"2_CR25","unstructured":"Imperva: Advanced DDoS Protection & Mitigation Services. https:\/\/www.imperva.com\/products\/ddos-protection-services\/. Accessed 11 Mar 2025"},{"key":"2_CR26","unstructured":"Imperva Documentation Portal. https:\/\/docs.imperva.com\/bundle\/cloud-application-security\/page\/introducing\/network-ddos-protection.htm. Accessed 14 June 2025"},{"key":"2_CR27","unstructured":"Jakma, P.: Revisions to the BGP \u2019Minimum Route Advertisement Interval\u2019. Internet-Draft draft-ietf-idr-mrai-dep-04, Internet Engineering Task Force (Sep 2011). https:\/\/datatracker.ietf.org\/doc\/draft-ietf-idr-mrai-dep\/04\/, work in Progress"},{"key":"2_CR28","doi-asserted-by":"crossref","unstructured":"Jonker, M., Sperotto, A., Pras, A.: DDoS mitigation: a measurement-based approach. In: NOMS 2020\u20132020 IEEE\/IFIP Network Operations and Management Symposium, pp. 1\u20136. IEEE (2020)","DOI":"10.1109\/NOMS47738.2020.9110320"},{"key":"2_CR29","doi-asserted-by":"crossref","unstructured":"Jonker, M., Sperotto, A., van Rijswijk-Deij, R., Sadre, R., Pras, A.: Measuring the adoption of DDoS protection services. In: Proceedings of the 2016 Internet Measurement Conference, pp. 279\u2013285 (2016)","DOI":"10.1145\/2987443.2987487"},{"key":"2_CR30","unstructured":"BGP Flowspec Doesn\u2019t Suck. We\u2019re Just Using it Wrong. https:\/\/www.kentik.com\/blog\/bgp-flowspec-doesnt-suck-were-just-using-it-wrong\/. Accessed 17 July 2025"},{"key":"2_CR31","doi-asserted-by":"crossref","unstructured":"Khadka, S., Bayhan, S., Holz, R., Shokoohi, S., Barcellos, M.: A first look at the adoption of BGP-based ddos scrubbing services: a 5-year longitudinal analysis. In: Proceedings of the 2025 International Conference on Network and Service Management (2025)","DOI":"10.23919\/CNSM67658.2025.11297552"},{"key":"2_CR32","doi-asserted-by":"crossref","unstructured":"Livadariu, I., Fontugne, R., Phokeer, A., Candela, M., Stucchi, M.: A tale of two synergies: Uncovering rpki practices for rtbh at ixps. In: International Conference on Passive and Active Network Measurement, pp. 88\u2013103. Springer (2024)","DOI":"10.1007\/978-3-031-56252-5_5"},{"key":"2_CR33","unstructured":"Letter of Agency (LOA) $$\\cdot $$ Cloudflare BYOIP docs. https:\/\/developers.cloudflare.com\/byoip\/concepts\/loa\/. Accessed 10 Oct 2025"},{"key":"2_CR34","unstructured":"L3\/L4 DDoS Mitigation | F5 Distributed Cloud Technical Knowledge. https:\/\/docs.cloud.f5.com\/docs-v2\/ddos-and-transit-services\/how-tos\/network-firewall\/l3l4-ddos-mitigation. Accessed 10 Oct 2025"},{"key":"2_CR35","unstructured":"Lumen RPKI Guide. https:\/\/assets.lumen.com\/is\/content\/Lumen\/rpki-customer-notification?Creativeid=1c967bb7-1321-4be8-92c0-74097e840849. Accessed 14 Oct 2025"},{"key":"2_CR36","unstructured":"MANRS: DataSheet Emergency OnboardingDDoS. https:\/\/real-sec.com\/wp-content\/uploads\/2022\/02\/DataSheet_Emergency_OnboardingDDoS.pdf. Accessed 06 Oct 2025"},{"key":"2_CR37","unstructured":"MANRS: MANRS. https:\/\/manrs.org\/. Accessed 01 Sept 2025"},{"key":"2_CR38","unstructured":"MANRS: MANRS+ Controls. https:\/\/manrs.org\/wp-content\/uploads\/2023\/12\/MANRSPlus_Controls.pdf. Accessed 01 Sept 2025"},{"key":"2_CR39","unstructured":"Mike Hicks: Akamai Prolexic Routed Outage Analysis. https:\/\/www.thousandeyes.com\/blog\/akamai-prolexic-routed-outage-analysis. Accessed 05 Feb 2025"},{"key":"2_CR40","unstructured":"nanog: Re: It can be challenging to advise DDoS mitigation subscribers on their RPKI-ROA needs, https:\/\/seclists.org\/nanog\/2024\/Oct\/73. Accessed 10 Oct 2025"},{"key":"2_CR41","unstructured":"NBIP. https:\/\/www.nbip.nl\/en\/nawas\/faq\/. Accessed 06 Oct 2025"},{"key":"2_CR42","unstructured":"Phil Gervasi: How Kentik Visualizes the BGP Propagation of a DDoS Mitigation (2022). https:\/\/www.kentik.com\/blog\/how-bgp-propagation-affects-ddos-mitigation\/. Accessed 14 Nov 2024"},{"key":"2_CR43","unstructured":"How Long Does a DDoS Attack Last?. https:\/\/www.netscout.com\/blog\/how-long-does-ddos-attack-last. Accessed 28 Sept 2025"},{"key":"2_CR44","unstructured":"Cloudflare Radar. https:\/\/radar.cloudflare.com\/. Accessed 17 Sept 2025"},{"key":"2_CR45","unstructured":"RADb. https:\/\/www.radb.net\/. Accessed 28 Sept 2025"},{"key":"2_CR46","unstructured":"Choosing the Best Diversion For Your Needs (2019). https:\/\/support.radware.com\/app\/answers\/answer_view\/a_id\/1018554\/related\/1. Accessed 05 Dec 2025"},{"key":"2_CR47","unstructured":"Radware Doc: DDoS Protector Cloud Service. https:\/\/www.radware.com\/getattachment\/bfc20642-47c5-4e1a-adb4-40350695541e\/ds-checkpoint-ddos-protector-cloud-service.pdf.aspx (2024). Accessed 12 Nov 2025"},{"key":"2_CR48","unstructured":"Radware Support: How to setup GRE tunnels (2019). https:\/\/support.radware.com\/app\/answers\/answer_view\/a_id\/1018552\/~\/how-to-setup-gre-tunnels. Accessed 05 Dec 2024"},{"key":"2_CR49","unstructured":"RIPE RPKI. https:\/\/ftp.ripe.net\/rpki\/. Accessed 17 Aug 2025"},{"key":"2_CR50","doi-asserted-by":"crossref","unstructured":"Sermpezis, P., Prehn, L., Kostoglou, S., Flores, M., Vakali, A., Aben, E.: Bias in internet measurement platforms. In: 2023 7th Network Traffic Measurement and Analysis Conference (TMA), pp. 1\u201310. IEEE (2023)","DOI":"10.23919\/TMA58422.2023.10198985"},{"key":"2_CR51","unstructured":"DDoS Hyper: DDoS Protection Solution | Lumen. https:\/\/www.lumen.com\/en-us\/security\/ddos-hyper.htm.html. Accessed 10 Oct 2025"},{"key":"2_CR52","unstructured":"eSecurity Planet. https:\/\/www.esecurityplanet.com\/products\/distributed-denial-of-service-ddos-protection-vendors\/. Accessed 10 Oct 2025"},{"key":"2_CR53","unstructured":"Team, Vercara: UltraDDoS protect - FAQs (2024). https:\/\/vercara.com\/resources\/ultraddos-protect. Accessed 19 Nov 2025"},{"key":"2_CR54","doi-asserted-by":"crossref","unstructured":"Testart, C., Richter, P., King, A., Dainotti, A., Clark, D.: Profiling BGP serial hijackers: capturing persistent misbehavior in the global routing table. In: Proceedings of the Internet Measurement Conference, pp. 420\u2013434 (2019)","DOI":"10.1145\/3355369.3355581"},{"key":"2_CR55","doi-asserted-by":"crossref","unstructured":"Tung, T.M., Wang, C., Wang, J.: Understanding the behaviors of BGP-based DDoS protection services. In: Man Ho Au et al. (ed.) Network and System Security, pp. 463\u2013473. Springer International Publishing (2018)","DOI":"10.1007\/978-3-030-02744-5_34"},{"key":"2_CR56","unstructured":"DDoS Protection Services | Cloud-based DDoS Mitigation | UltraDDoS Protect. https:\/\/vercara.digicert.com\/ddos-protection. Accessed 19 Nov 2025"},{"key":"2_CR57","unstructured":"Release Note: DDoS Protection for Networks - Manually divert your ranges | Imperva Cyber Community. https:\/\/community.imperva.com\/discussion\/release-note-ddos-protection-for-networks-manually-divert-your-ranges. Accessed 19 Nov 2025"},{"key":"2_CR58","unstructured":"Wallace Lee: DDoS Protection for Networks: Combatting Local Preference from ISPs | Imperva (2020). https:\/\/www.imperva.com\/blog\/ddos-protection-for-networks-combatting-local-preference-from-isps\/. Accessed 16 July2025"}],"container-title":["Lecture Notes in Computer Science","Passive and Active Measurement"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-18268-5_2","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T16:52:11Z","timestamp":1773075131000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-18268-5_2"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032182678","9783032182685"],"references-count":58,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-18268-5_2","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"10 March 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"Our work raises no ethical concerns. Our analysis relies on publicly available datasets.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical Considerations"}},{"value":"PAM","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Passive and Active Network Measurement","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 March 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"25 March 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"pam2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/pam2026.at","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}