The BGP Visibility Toolkit: Detecting Anomalous Internet Routing Behavior

Abstract

In this paper, we propose the BGP Visibility Toolkit, a system for detecting and analyzing anomalous behavior in the Internet. We show that interdomain prefix visibility can be used to single out cases of erroneous demeanors resulting from misconfiguration or bogus routing policies. The implementation of routing policies with BGP is a complicated process, involving fine-tuning operations and interactions with the policies of the other active ASes. Network operators might end up with faulty configurations or unintended routing policies that prevent the success of their strategies and impact their revenues. As part of the Visibility Toolkit, we propose the BGP Visibility Scanner, a tool which identifies limited visibility prefixes in the Internet. The tool enables operators to provide feedback on the expected visibility status of prefixes. We build a unique set of ground-truth prefixes qualified by their ASes as intended or unintended to have limited visibility. Using a machine learning algorithm, we train on this unique dataset an alarm system that separates with 95% accuracy the prefixes with unintended limited visibility. Hence, we find that visibility features are generally powerful to detect prefixes which are suffering from inadvertent effects of routing policies. Limited visibility could render a whole prefix globally unreachable. This points towards a serious problem, as limited reachability of a non-negligible set of prefixes undermines the global connectivity of the Internet. We thus verify the correlation between global visibility and global connectivity of prefixes.

Comparing Machine Learning Algorithms for BGP Anomaly Detection using Graph Features

“…Previous work already showed that SVM [13], NB [5], DT [24], and NN [10] provided satisfactory results in detecting anomalies in BGP. In addition, these techniques are the most common binary classification methods [25], which are appropriate in classifying between anomalous and non-anomalous events.…”

“…In this paper, we provide a rigorous evaluation of the aforementioned graph features through an extensive comparison of different ML algorithms used in BGP anomaly detection, i.e., Naive Bayes classifier (NB) [5], Decision Trees (DT) [24], Random Forests (RF), Support Vector Machines (SVM) [13], and Neural Networks (NN) [10], that use graph features to detect BGP path leaks. Our results indicate that these algorithms are able to detect anomalies, which demonstrate that graph features do not depend on any ML method to show their strength as data input predictors.…”

Network anomaly detection research: a survey

“…Study in [39] proposes a principal component analysis (PCA)-based anomaly method whilst study in [40] uses a PCA sparse. Authors in [41] propose a toolkit for analyzing and detecting anomalous behavior on the Internet. The works in [42]- [44] propose an anomalous mobile agent-based detection scheme, diagnostic and detection of occurrences on a network-wide, and PCA-based distributed-anomaly detection scheme, respectively.…”

The state of affairs in BGP security: A survey of attacks and defenses

“…Zhang et al [158] relied on unsupervised clustering techniques to recognize deviations from the normal state of BGP data flow. Lutu et al [159] argued that prefixes that are less visible in the Internet than expected by the prefix owners is an indicator for routing issues. The authors periodically collected BGP messages from vantage points and assigned a visibility degree to each prefix based on the fraction of ASs that have an active stable route for it.…”