System and method to select monitors that detect prefix hijacking events

A monitor selection system to select candidate prefix hijack monitors, the system comprising a computing device configured to execute modules comprising:

• a cluster module configured to:
• assign each of the candidate prefix hijack monitors to a respective cluster of a plurality of clusters, each of the candidate prefix hijack monitors associated with an autonomous system (AS) that indicates an AS path of autonomous systems (ASes) from the AS to a destination prefix associated with a destination AS;
• and
• iteratively merge a pair of clusters with a highest similarity score amongst cluster pairs of the plurality of clusters into a single cluster until a processed number of clusters is less than or equal to a predetermined number of clusters;
• a rank module configured to rank each candidate prefix hijack monitor of each of the processed number of clusters according to a route type from an AS associated with the candidate prefix hijack monitor and an AS distance from the AS associated with the candidate prefix hijack monitor to the destination AS;
• and
• a determination module configured to determine a highest ranked candidate prefix hijack monitor of each of the processed number of clusters.

A computer-readable non-transitory storage medium comprising operational instructions for selecting candidate prefix hijack monitors, the instructions, when executed by a processor, cause the processor to:

• assign each of the candidate prefix hijack monitors to a respective cluster of a plurality of clusters, each of the candidate prefix hijack monitors associated with an autonomous system (AS) that indicates an AS path of autonomous systems (ASes) from the AS to a destination prefix associated with a destination AS;
• iteratively merge a pair of clusters with a highest similarity score amongst cluster pairs of the plurality of clusters into a single cluster until a processed number of clusters is less than or equal to a predetermined number of clusters;
• rank each candidate prefix hijack monitor of each of the processed number of clusters according to a route type from an AS associated with the candidate prefix hijack monitor and an AS distance from the AS associated with the candidate prefix hijack monitor to the destination AS;
• and
• determine highest a ranked candidate prefix hijack monitor of each of the processed number of clusters.