GonoGo - Assessing the Confidence Level of Distribute Intrusion Detection Systems Alarms Based on BGP

Abstract

Although Border Gateway Protocol – BGP is increasingly becoming a multi-purpose protocol, it suffers from security issues regarding bogus announcements for malicious goals. Some of these security breaches are particularly critical for distributed intrusion detection systems that use BGP as their underlay network for interchanging alarms. In this case, assessing the confidence level of these BGP messages helps to prevent internal attacks. Most of the proposals addressing the confidence level of BGP messages rely on complex and time-consuming mechanisms that can also be a potential target for intelligent attacks. In this paper, we propose Gonogo as an out-of-band system based on machine learning to infer the confidence level of the intrusion alarms using just the mandatory header of each BGP message that transports them. Tests using a synthetic data set reflecting the indirect effects of a widespread worm attack over the BGP network show promising results, considering well-known performance metrics, such as recall, accuracy, receiver operating characteristics (ROC), and f1-score.