Abstract
Detecting anomalous BGP-route advertisements is crucial for improving the security and robustness of the Internet's interdomain-routing system. In this paper, we propose an instance-learning framework that identifies anomalies based on deviations from the "normal" BGP-update dynamics for a given destination prefix and across prefixes. We employ wavelets for a systematic, multi-scaled analysis that avoids the "magic numbers" (e.g., for grouping related update messages) needed in previous approaches to BGP-anomaly detection. Our preliminary results show that the update dynamics are generally consistent across prefixes and time. Only a few prefixes differ from the majority, and most prefixes exhibit similar behavior across time. This small set of abnormal prefixes and time intervals may be further examined to determine the source of anomalous behavior. In particular, we observe that many of the unusual prefixes are unstable prefixes that experience frequent routing changes.
Original language | English (US) |
---|---|
Title of host publication | Proceedings of ACM SIGCOMM 2005 Workshops |
Subtitle of host publication | Conference on Computer Communications |
Pages | 219-220 |
Number of pages | 2 |
State | Published - Dec 30 2005 |
Event | ACM SIGCOMM 2005 Workshops: Conference on Computer Communications - Philadelphia, PA, United States Duration: Aug 22 2005 → Aug 26 2005 |
Other
Other | ACM SIGCOMM 2005 Workshops: Conference on Computer Communications |
---|---|
Country/Territory | United States |
City | Philadelphia, PA |
Period | 8/22/05 → 8/26/05 |
All Science Journal Classification (ASJC) codes
- General Engineering