Martino Trevisan

The Border Gateway Protocol (BGP) lacks native mechanisms to verify that routes adhere to authorized paths. This makes the global infrastructure vulnerable to route leaks, which have caused several major Internet disruptions. Autonomous System Provider Authorization (ASPA) is an emerging technology, currently at Internet-draft stage, that extends the Resource Public Key Infrastructure (RPKI) by allowing ASes to cryptographically declare their upstream providers; prior work has shown its effectiveness in detecting route leaks and certain forms of path manipulation. Yet, as ASPA moves toward standardization and Regional Internet Registries enable it in their RPKI dashboards, its actual deployment, operational dynamics, and alignment with independently inferred relationships remain unstudied. In this paper, we present the first measurement study of real-world ASPA deployment, tracing the evolution of 1646 adopting ASes from October 2023 to March 2026. We further introduce a methodology to apply ASPA AS Path verification—originally designed for live BGP routers—to passively collected BGP data, and use it to identify thousands of potential route leaks across nearly 57 million AS Paths. Finally, we compare ASPA-declared providers against two publicly available datasets of inferred providers, and find a recall up to 93 % when accounting for our limited visibility into the routing ecosystem.

The complexity and scale of Internet attacks call for distributed, cooperative observatories capable of monitoring malicious traffic across diverse networks. Holoscope is a lightweight, cloud-native platform designed to simplify the deployment and management of distributed telescope (passive) and honeypot (active) sensors, used to collect and analyse attack traffic by exposing or simulating vulnerable systems. Built upon K3s and WireGuard, Holoscope offers secure connectivity, automated node onboarding, and resilient operation even in resource-constrained environments. Through modular design and Infrastructure-as-Code principles, it supports dynamic sensor orchestration, automated recovery and processing. We build, deploy and operate Holoscope across multiple institutions and cloud networks in Europe and Brazil, enabling unified visibility into large-scale attack phenomena while maintaining ease of integration and security compliance.