Two different threats need two different defences. Protecting the session means stopping someone forming or spoofing a peering: TCP-AO or MD5 passwords authenticate the peer, and GTSM (the TTL security check) ensures an eBGP packet arrived with TTL 255, proving it came from a directly connected device and not a spoofed remote source. Protecting the routes means not believing bad announcements: maximum-prefix caps how many a peer may send, and RPKI validates that the AS originating a prefix is actually authorised to.

RPKI origin validation checks each prefix's origin AS against signed ROAs and marks routes valid, invalid or not-found, so you can drop or de-prefer invalids — defence against origin hijacks. RTBH (Remotely Triggered Black Hole) is the reverse tool: to stop a DDoS, you advertise the victim prefix tagged with a community that every router maps to a null next hop, dropping the attack traffic at the edge before it reaches the victim. One validates what you accept; the other weaponises BGP to discard traffic on purpose.