Abstract: A route monitoring system disclosed herein includes a computing system executing a route monitoring service coupled to a communication network. The route monitoring service receives a route redirection message from one or more network elements in a communication network, and compares the route update information against one or more normalcy rules associated with potential malicious route redirecting mechanisms. The route redirection message includes route update information defining a change to a route through the communication network. When the comparison of the route update information to the one or more normalcy rules identifies a malicious route redirection attack, the service generates one or more remedial actions to mitigate the redirection attack.