Understanding and Utilizing the Hierarchy of Abnormal BGP Events

Abnormal events, such as security attacks, misconfigurations, or electricity failures, could have severe consequences toward the normal operation of the Border Gateway Protocol (BGP) that is in charge of the delivery of packets between different autonomous domains, a key operation for the Internet to function. Unfortunately, it has been a difficult task for network security researchers and engineers to classify and detect these events. In our previous work, we have shown that with classification (which relies on the labeling with domain knowledge from BGP experts), it is feasible to effectively detect and distinguish some worms and blackouts from normal BGP behaviors. In this paper, we move one important step forward—we show that we can automatically detect and classify between different abnormal BGP events based on a hierarchy discovered by clustering. As a systematic application of data mining, we devise a clustering method based on normalized BGP data that forms a tree-like ...

• Type: Conference
• Year: 2007
• Where: SDM
• Authors: Dejing Dou, Jun Li, Han Qin, Shiwoong Kim, Sheng Zhong
• Keywords: Abnormal Bgp Event, BGP Data, Data Mining, Different Abnormal Bgp, SDM 2007