Sciweavers

Share
MINENET
2005
ACM

Learning-based anomaly detection in BGP updates

12 years 1 months ago
Learning-based anomaly detection in BGP updates
Detecting anomalous BGP-route advertisements is crucial for improving the security and robustness of the Internet’s interdomain-routing system. In this paper, we propose an instance-learning framework that identifies anomalies based on deviations from the “normal” BGP-update dynamics for a given destination prefix and across prefixes. We employ wavelets for a systematic, multi-scaled analysis that avoids the “magic numbers” (e.g., for grouping related update messages) needed in previous approaches to BGP-anomaly detection. Our preliminary results show that the update dynamics are generally consistent across prefixes and time. Only a few prefixes differ from the majority, and most prefixes exhibit similar behavior across time. This small set of abnormal prefixes and time intervals may be further examined to determine the source of anomalous behavior. In particular, we observe that many of the unusual prefixes are unstable prefixes that experience frequent routing ch...
Jian Zhang, Jennifer Rexford, Joan Feigenbaum
Added 26 Jun 2010
Updated 26 Jun 2010
Type Conference
Year 2005
Where MINENET
Authors Jian Zhang, Jennifer Rexford, Joan Feigenbaum
Comments (0)
books