TY - GEN
T1 - Learning-based anomaly detection in BGP updates
AU - Zhang, Jian
AU - Rexford, Jennifer L.
AU - Feigenbaum, Joan
PY - 2005
Y1 - 2005
N2 - Detecting anomalous BGP-route advertisements is crucial for improving the security and robustness of the Internet's interdomain-routing system. In this paper, we propose an instance-learning framework that identifies anomalies based on deviations from the "normal" BGP-update dynamics for a given destination prefix and across prefixes. We employ wavelets for a systematic, multi-scaled analysis that avoids the "magic numbers" (e.g., for grouping related update messages) needed in previous approaches to BGP-anomaly detection. Our preliminary results show that the update dynamics are generally consistent across prefixes and time. Only a few prefixes differ from the majority, and most prefixes exhibit similar behavior across time. This small set of abnormal prefixes and time intervals may be further examined to determine the source of anomalous behavior. In particular, we observe that many of the unusual prefixes are unstable prefixes that experience frequent routing changes.
AB - Detecting anomalous BGP-route advertisements is crucial for improving the security and robustness of the Internet's interdomain-routing system. In this paper, we propose an instance-learning framework that identifies anomalies based on deviations from the "normal" BGP-update dynamics for a given destination prefix and across prefixes. We employ wavelets for a systematic, multi-scaled analysis that avoids the "magic numbers" (e.g., for grouping related update messages) needed in previous approaches to BGP-anomaly detection. Our preliminary results show that the update dynamics are generally consistent across prefixes and time. Only a few prefixes differ from the majority, and most prefixes exhibit similar behavior across time. This small set of abnormal prefixes and time intervals may be further examined to determine the source of anomalous behavior. In particular, we observe that many of the unusual prefixes are unstable prefixes that experience frequent routing changes.
KW - Anomaly Detection
KW - Instance-Based Learning
KW - Wavelets
UR - http://www.scopus.com/inward/record.url?scp=63049104703&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=63049104703&partnerID=8YFLogxK
U2 - 10.1145/1080173.1080189
DO - 10.1145/1080173.1080189
M3 - Conference contribution
AN - SCOPUS:63049104703
SN - 1595930264
SN - 9781595930262
T3 - Proceedings of ACM SIGCOMM 2005 Workshops: Conference on Computer Communications
SP - 219
EP - 220
BT - Proceedings of ACM SIGCOMM 2005 Workshops
PB - Association for Computing Machinery
T2 - ACM SIGCOMM 2005 Workshops: Conference on Computer Communications
Y2 - 22 August 2005 through 26 August 2005
ER -