Learning-based anomaly detection in BGP updates

Jian Zhang, Jennifer L. Rexford, Joan Feigenbaum

Research output: Chapter in Book/Report/Conference proceedingConference contribution


Detecting anomalous BGP-route advertisements is crucial for improving the security and robustness of the Internet's interdomain-routing system. In this paper, we propose an instance-learning framework that identifies anomalies based on deviations from the "normal" BGP-update dynamics for a given destination prefix and across prefixes. We employ wavelets for a systematic, multi-scaled analysis that avoids the "magic numbers" (e.g., for grouping related update messages) needed in previous approaches to BGP-anomaly detection. Our preliminary results show that the update dynamics are generally consistent across prefixes and time. Only a few prefixes differ from the majority, and most prefixes exhibit similar behavior across time. This small set of abnormal prefixes and time intervals may be further examined to determine the source of anomalous behavior. In particular, we observe that many of the unusual prefixes are unstable prefixes that experience frequent routing changes.

Original languageEnglish (US)
Title of host publicationProceedings of ACM SIGCOMM 2005 Workshops
Subtitle of host publicationConference on Computer Communications
Number of pages2
StatePublished - Dec 30 2005
EventACM SIGCOMM 2005 Workshops: Conference on Computer Communications - Philadelphia, PA, United States
Duration: Aug 22 2005Aug 26 2005


OtherACM SIGCOMM 2005 Workshops: Conference on Computer Communications
Country/TerritoryUnited States
CityPhiladelphia, PA

All Science Journal Classification (ASJC) codes

  • Engineering(all)


Dive into the research topics of 'Learning-based anomaly detection in BGP updates'. Together they form a unique fingerprint.

Cite this