BGP anomaly detection using the raw internet topology

The Border Gateway Protocol (BGP) is central to the global connectivity of the Internet, enabling fast and efficient dissemination of routing information. Hence, detecting any anomaly concerning BGP announcements is of critical importance to ensure the continuous operation of Internet services. Typically, BGP anomaly detection algorithms have relied on features of the BGP messages, such as the average length of the AS_PATH attribute, the volume of messages, or the type of message (announcement or withdrawal). Even though these algorithms provide good performance, they do not take into account the Internet topology, that is, the graph of Autonomous Systems (AS) created by the BGP announcements. In addition, some of the existing algorithms can detect only specific types of anomalies, while others require retraining them to support new scenarios.

In this paper we propose detecting BGP anomalies by leveraging the raw BGP topology graph, instead of manually curated features of the BGP messages. We implement a Machine Learning algorithm to process the entire BGP topology and evaluate it with real-world data from 4 well-known incidents. We compare our proposal against two state-of-the-art solutions and a classical method that use BGP features and features of the BGP topology, not the topology itself. Our results show that our solution obtains remarkable performance identifying the incidents. Finally, we test our model with regular data (non-anomalous) to prove that it can be used in a production scenario, with samples processed on the fly and guaranteeing a low false alarm rate.