Sentinel / Routing security research
Investigate changes in internet routing.
Sentinel watches BGP origin changes and brings routing records into one workspace, so operators can examine the evidence and document a conclusion.
The demo is open to everyone. Check beta availability for account access.
Address range
192.0.2.0/24
Previous origin
AS64496New origin
AS64497The network announcing this range has changed. In this teaching case, a recorded authorization supports the new origin.
Authorization matches. The operator’s migration notice supplies the missing context.
Follow this example in the workspace →The process
How a review works.
An observation starts the investigation. The evidence helps an operator decide what it means.
Observe the change
Monitor announcements from RIPE RIS Live. Use model scores and routing context to prioritize changes for closer inspection.
Examine the evidence
Consult route authorizations, announcement history, registration data, and supported carrier records. Keep the sources alongside the observation.
Record a conclusion
Review related observations, explain the decision, and retain the review history. Mark the outcome as uncertain when the evidence is incomplete.
The question we are testing
Can better evidence make review more useful?
Sentinel focuses on the investigation that follows an origin-change observation.
Keep the original records. Explain what supports a change, what conflicts, and what is still unknown. Preserve how an operator reached a conclusion.
The private workspace reports review coverage, agreement between distinct reviewers, and descriptive results on reviewed observations. It does not yet establish detection accuracy across the internet.
How this relates to existing research
BGP monitoring and evidence-based investigation have substantial prior work. ARTEMIS combines operator-focused detection and mitigation; CAIDA’s HIJACKS research investigates routing events using multiple measurement sources.
Sentinel’s research direction is to evaluate source provenance, unresolved evidence, and versioned human reviews together. This is a design focus and a hypothesis to test, not a claim of being the first system or outperforming those projects.
Research notes
Interpreting the evidence.
A new route origin may reflect legitimate provisioning, a measurement artifact, or a routing incident. A model score alone cannot distinguish these conclusively.
Sentinel is experimental research software. Scores are not calibrated incident probabilities, and source availability and collection gaps affect coverage. Consequential decisions require independent verification.
Access
Explore Sentinel.
Try the public demonstration to follow three fictional cases from a routing change to its supporting evidence. The demo is read only and contains no private incident data.
The free public beta is designed for following selected routing observations, understanding recorded scores, and saving a personal network watchlist. Check beta availability for current registration status. Invited operators can sign in to the private evidence and review workspace.
Sign in to Sentinel