Learning-based anomaly detection in BGP updates

14 years 6 months ago

Download www.cs.princeton.edu

Detecting anomalous BGP-route advertisements is crucial for improving the security and robustness of the Internet’s interdomain-routing system. In this paper, we propose an instance-learning framework that identiﬁes anomalies based on deviations from the “normal” BGP-update dynamics for a given destination preﬁx and across preﬁxes. We employ wavelets for a systematic, multi-scaled analysis that avoids the “magic numbers” (e.g., for grouping related update messages) needed in previous approaches to BGP-anomaly detection. Our preliminary results show that the update dynamics are generally consistent across preﬁxes and time. Only a few preﬁxes diﬀer from the majority, and most preﬁxes exhibit similar behavior across time. This small set of abnormal preﬁxes and time intervals may be further examined to determine the source of anomalous behavior. In particular, we observe that many of the unusual preﬁxes are unstable preﬁxes that experience frequent routing ch...

Jian Zhang, Jennifer Rexford, Joan Feigenbaum

Real-time Traffic