Learning-Based Anomaly Detection in BGP Updates

Full textClick to download.
CitationYale University Technical Report YALEU/DCS/TR-1318, April 2005. Abstract appears in Proceedings of the 2005 ACM Sigcomm Workshop on Mining Network Data (MineNet '05), page 219-220.
AuthorsJian Zhang
Jennifer Rexford
Joan Feigenbaum


We propose an instance-learning based framework for detecting BGP routing anomalies. By using a vector of quantified features to represent BGP updates, our framework can capture more complex features of BGP updates than previous methods that use simple aggregation. The feature vector is based on BGP-update dynamics and is constructed using wavelet transformations. The transformations provide a systematic, multi-scaled analysis of the dynamics and thus avoid using "magic numbers" that are hard to determine. We experiment with a preliminary implementation of our framework, investigating daily BGP-update behaviors for six months. Focusing on each prefix in isolation, we show that, for most prefixes, update dynamics are similar from day to day. Furthermore, on a single day, most prefixes also display similar dynamics. Only a few prefixes exhibit behaviors that are quite different from the majority. The small set of prefixes or daily behaviors can be further examined for anomaly detection. In particular, we observe that most prefixes whose update dynamics deviate from the majority are unstable prefixes with frequent routing changes.

Back to publications
Back to previous page