{"id":"https://openalex.org/W7116794131","doi":"https://doi.org/10.23919/cnsm67658.2025.11297552","title":"A First Look at the Adoption of BGP-based DDoS Scrubbing Services: A 5-year Longitudinal Analysis","display_name":"A First Look at the Adoption of BGP-based DDoS Scrubbing Services: A 5-year Longitudinal Analysis","publication_year":2025,"publication_date":"2025-10-27","ids":{"openalex":"https://openalex.org/W7116794131","doi":"https://doi.org/10.23919/cnsm67658.2025.11297552"},"language":"en","primary_location":{"id":"doi:10.23919/cnsm67658.2025.11297552","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297552","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://ris.utwente.nl/ws/files/517868859/BGP_based_scrubbing_services.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5018589115","display_name":"Shyam Krishna Khadka","orcid":"https://orcid.org/0000-0003-3660-6226"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Shyam Krishna Khadka","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041994291","display_name":"Suzan Bayhan","orcid":"https://orcid.org/0000-0001-6662-704X"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Suzan Bayhan","raw_affiliation_strings":["University of Twente,Enschede,The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente,Enschede,The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005480813","display_name":"Ralph Holz","orcid":"https://orcid.org/0000-0001-9614-2377"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ralph Holz","raw_affiliation_strings":["University of Münster,Münster,Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Münster,Münster,Germany","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011581985","display_name":"Saeedeh Shokoohi","orcid":null},"institutions":[{"id":"https://openalex.org/I52179390","display_name":"University of Waikato","ror":"https://ror.org/013fsnh78","country_code":"NZ","type":"education","lineage":["https://openalex.org/I52179390"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Saeedeh Shokoohi","raw_affiliation_strings":["University of Waikato,Hamilton,New Zealand"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Waikato,Hamilton,New Zealand","institution_ids":["https://openalex.org/I52179390"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023690641","display_name":"Marinho Barcellos","orcid":"https://orcid.org/0000-0002-1505-6408"},"institutions":[{"id":"https://openalex.org/I52179390","display_name":"University of Waikato","ror":"https://ror.org/013fsnh78","country_code":"NZ","type":"education","lineage":["https://openalex.org/I52179390"]}],"countries":["NZ"],"is_corresponding":false,"raw_author_name":"Marinho Barcellos","raw_affiliation_strings":["University of Waikato,Hamilton,New Zealand"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Waikato,Hamilton,New Zealand","institution_ids":["https://openalex.org/I52179390"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5018666006","display_name":"Cristian Hesselman","orcid":"https://orcid.org/0000-0002-7052-9300"},"institutions":[{"id":"https://openalex.org/I4210154420","display_name":"SIDN Fonds","ror":"https://ror.org/05cej7184","country_code":"NL","type":"other","lineage":["https://openalex.org/I4210154420"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Cristian Hesselman","raw_affiliation_strings":["SIDN Labs,Arnhem,The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SIDN Labs,Arnhem,The Netherlands","institution_ids":["https://openalex.org/I4210154420"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.5529,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.86558188,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":93,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.23240000009536743,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.23240000009536743,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10138","display_name":"Network Traffic and Congestion Control","score":0.058400001376867294,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10080","display_name":"Energy Efficient Wireless Sensor Networks","score":0.034299999475479126,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.8492000102996826},{"id":"https://openalex.org/keywords/border-gateway-protocol","display_name":"Border Gateway Protocol","score":0.6355999708175659},{"id":"https://openalex.org/keywords/application-layer-ddos-attack","display_name":"Application layer DDoS attack","score":0.526199996471405},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.46720001101493835},{"id":"https://openalex.org/keywords/trinoo","display_name":"Trinoo","score":0.462799996137619},{"id":"https://openalex.org/keywords/anycast","display_name":"Anycast","score":0.4262999892234802},{"id":"https://openalex.org/keywords/tier-1-network","display_name":"Tier 1 network","score":0.3953000009059906},{"id":"https://openalex.org/keywords/ipv4","display_name":"IPv4","score":0.39469999074935913},{"id":"https://openalex.org/keywords/routing-protocol","display_name":"Routing protocol","score":0.37860000133514404}],"concepts":[{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.8492000102996826},{"id":"https://openalex.org/C178086212","wikidata":"https://www.wikidata.org/wiki/Q11155","display_name":"Border Gateway Protocol","level":5,"score":0.6355999708175659},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6335999965667725},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6327000260353088},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5313000082969666},{"id":"https://openalex.org/C120865594","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Application layer DDoS attack","level":4,"score":0.526199996471405},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.46720001101493835},{"id":"https://openalex.org/C43639116","wikidata":"https://www.wikidata.org/wiki/Q7843050","display_name":"Trinoo","level":5,"score":0.462799996137619},{"id":"https://openalex.org/C122005561","wikidata":"https://www.wikidata.org/wiki/Q613897","display_name":"Anycast","level":3,"score":0.4262999892234802},{"id":"https://openalex.org/C23976947","wikidata":"https://www.wikidata.org/wiki/Q2193193","display_name":"Tier 1 network","level":3,"score":0.3953000009059906},{"id":"https://openalex.org/C2779233093","wikidata":"https://www.wikidata.org/wiki/Q11103","display_name":"IPv4","level":4,"score":0.39469999074935913},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.37860000133514404},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.37139999866485596},{"id":"https://openalex.org/C141603448","wikidata":"https://www.wikidata.org/wiki/Q134830","display_name":"Prefix","level":2,"score":0.3528999984264374},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.33809998631477356},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.3359000086784363},{"id":"https://openalex.org/C116537","wikidata":"https://www.wikidata.org/wiki/Q2169973","display_name":"Service provider","level":3,"score":0.3337000012397766},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.305400013923645},{"id":"https://openalex.org/C74172769","wikidata":"https://www.wikidata.org/wiki/Q1446839","display_name":"Routing (electronic design automation)","level":2,"score":0.2980000078678131},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.296999990940094},{"id":"https://openalex.org/C9628104","wikidata":"https://www.wikidata.org/wiki/Q788009","display_name":"Autonomous system (mathematics)","level":2,"score":0.2937999963760376},{"id":"https://openalex.org/C2778000800","wikidata":"https://www.wikidata.org/wiki/Q830043","display_name":"Handshake","level":3,"score":0.2858000099658966},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.2687000036239624},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.26589998602867126},{"id":"https://openalex.org/C145097563","wikidata":"https://www.wikidata.org/wiki/Q1148747","display_name":"Payment","level":2,"score":0.2524999976158142},{"id":"https://openalex.org/C35341882","wikidata":"https://www.wikidata.org/wiki/Q8795","display_name":"Internet Protocol","level":3,"score":0.25119999051094055},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.2508000135421753}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.23919/cnsm67658.2025.11297552","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297552","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},{"id":"pmh:oai:ris.utwente.nl:openaire/44edbf4b-0bbd-4ccb-93f7-2bb706011fe5","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/44edbf4b-0bbd-4ccb-93f7-2bb706011fe5","pdf_url":"https://ris.utwente.nl/ws/files/517868859/BGP_based_scrubbing_services.pdf","source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Khadka, S K, Bayhan, S, Holz, R, Shokoohi, S, Barcellos, M & Hesselman, C E W 2025, A First Look at the Adoption of BGP-based DDoS Scrubbing Services: A 5-year Longitudinal Analysis. in 2025 21st International Conference on Network and Service Management (CNSM). 21st International Conference on Network and Service Management, CNSM 2025, Bologna, Italy, 27/10/25. https://doi.org/10.23919/CNSM67658.2025.11297552","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"pmh:oai:ris.utwente.nl:openaire/44edbf4b-0bbd-4ccb-93f7-2bb706011fe5","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/44edbf4b-0bbd-4ccb-93f7-2bb706011fe5","pdf_url":"https://ris.utwente.nl/ws/files/517868859/BGP_based_scrubbing_services.pdf","source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Khadka, S K, Bayhan, S, Holz, R, Shokoohi, S, Barcellos, M & Hesselman, C E W 2025, A First Look at the Adoption of BGP-based DDoS Scrubbing Services: A 5-year Longitudinal Analysis. in 2025 21st International Conference on Network and Service Management (CNSM). 21st International Conference on Network and Service Management, CNSM 2025, Bologna, Italy, 27/10/25. https://doi.org/10.23919/CNSM67658.2025.11297552","raw_type":"info:eu-repo/semantics/conferenceObject"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/2","score":0.6215863823890686,"display_name":"Zero hunger"}],"awards":[{"id":"https://openalex.org/G4002167081","display_name":"Controllable, Accountable, Transparent: the Responsible Internet (CATRIN)","funder_award_id":"NWA.1215.18.003","funder_id":"https://openalex.org/F4320321800","funder_display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek"},{"id":"https://openalex.org/G984747409","display_name":"U\u200bser-driven P\u200bath Verification and Control for \u200bI\u200bnter-domain \u200bN\u200betworks (UPIN)","funder_award_id":"CS.004","funder_id":"https://openalex.org/F4320321800","funder_display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek"}],"funders":[{"id":"https://openalex.org/F4320321800","display_name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek","ror":"https://ror.org/04jsz6e67"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7116794131.pdf","grobid_xml":"https://content.openalex.org/works/W7116794131.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Besides":[0],"being":[1],"the":[2,8,10,58,61,75,100,131,161,172,220,238,248],"de":[3],"facto":[4],"routing":[5,111],"protocol":[6],"of":[7,23,34,99,133,138,163,240,250],"Internet,":[9],"Border":[11],"Gateway":[12],"Protocol":[13],"(BGP)":[14],"has":[15,140,166],"also":[16,167,230],"been":[17],"used":[18],"for":[19,27,214,233,245],"mitigating":[20],"Distributed":[21],"Denial":[22],"Service":[24],"(DDoS)":[25],"attacks":[26,36],"many":[28,67],"years.":[29],"In":[30],"such":[31],"situations,":[32],"victims":[33],"DDoS":[35,54,69,241,251],"use":[37],"BGP":[38,110],"to":[39,43,60,83,123,147,153,177,182,218,236],"redirect":[40],"attack":[41],"traffic":[42,52,55],"a":[44,193],"\u201cscrubber\u201d":[45],"outside":[46],"their":[47,72,120,125],"network,":[48],"which":[49],"separates":[50],"clean":[51],"from":[53,150,175,180],"and":[56,89,94,149,158,179,188,244],"forwards":[57],"former":[59],"victim\u2019s":[62],"network.":[63],"While":[64],"there":[65],"exist":[66],"BGP-based":[68],"scrubbing":[70,102],"providers,":[71,103],"adoption":[73,195,201,239],"on":[74,116],"global":[76],"Internet":[77],"remains":[78,202],"unstudied.":[79],"This":[80],"paper":[81],"aims":[82],"fill":[84],"this":[85,136],"gap":[86],"by":[87,97],"identifying":[88],"characterizing":[90],"Autonomous":[91],"Systems":[92],"(ASes)":[93],"prefixes":[95,126,165],"protected":[96,121,164],"five":[98],"leading":[101],"using":[104,135],"AS":[105,216],"path":[106],"patterns":[107],"in":[108,171],"public":[109],"data.":[112],"Our":[113],"study":[114],"focuses":[115],"scrubbers":[117],"that":[118,130,225],"allow":[119],"ASes":[122,134,152],"originate":[124],"themselves.":[127],"We":[128,207],"find":[129,219],"percentage":[132,162],"kind":[137],"protection":[139,242],"increased":[141,168],"almost":[142],"three":[143,169],"times":[144,170],"(from":[145],"0.7%":[146],"2%":[148],"464":[151],"1,730":[154],"ASes)":[155],"between":[156],"2020":[157],"2024.":[159],"Similarly,":[160],"same":[173],"period,":[174],"0.3%":[176],"0.9%":[178],"3,154":[181],"12,362":[183],"prefixes,":[184],"across":[185],"both":[186],"IPv4":[187],"IPv6.":[189],"Globally,":[190],"we":[191],"observe":[192],"higher":[194],"rate":[196],"among":[197,204],"financial":[198],"institutions,":[199],"while":[200],"low":[203],"educational":[205],"institutions.":[206],"believe":[208],"our":[209],"insights":[210],"will":[211],"be":[212,231],"useful":[213,232],"individual":[215],"operators":[217],"transit":[221],"providers":[222],"or":[223],"peers":[224],"are":[226],"DDoS-protected.":[227],"It":[228],"might":[229],"(national)":[234],"policy-makers":[235],"incentivize":[237],"services":[243],"researchers":[246],"studying":[247],"phenomenon":[249],"scrubbing.":[252]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-08-26T07:47:46.906454","created_date":"2025-12-22T00:00:00"}