Learning-based anomaly detection in BGP updates

Jian Zhang, Jennifer L. Rexford, Joan Feigenbaum

Research output: Chapter in Book/Report/Conference proceedingConference contribution

42 Scopus citations


Detecting anomalous BGP-route advertisements is crucial for improving the security and robustness of the Internet's interdomain-routing system. In this paper, we propose an instance-learning framework that identifies anomalies based on deviations from the "normal" BGP-update dynamics for a given destination prefix and across prefixes. We employ wavelets for a systematic, multi-scaled analysis that avoids the "magic numbers" (e.g., for grouping related update messages) needed in previous approaches to BGP-anomaly detection. Our preliminary results show that the update dynamics are generally consistent across prefixes and time. Only a few prefixes differ from the majority, and most prefixes exhibit similar behavior across time. This small set of abnormal prefixes and time intervals may be further examined to determine the source of anomalous behavior. In particular, we observe that many of the unusual prefixes are unstable prefixes that experience frequent routing changes.

Original languageEnglish (US)
Title of host publicationProceedings of ACM SIGCOMM 2005 Workshops
Subtitle of host publicationConference on Computer Communications
PublisherAssociation for Computing Machinery
Number of pages2
ISBN (Print)1595930264, 9781595930262
StatePublished - 2005
EventACM SIGCOMM 2005 Workshops: Conference on Computer Communications - Philadelphia, PA, United States
Duration: Aug 22 2005Aug 26 2005

Publication series

NameProceedings of ACM SIGCOMM 2005 Workshops: Conference on Computer Communications


OtherACM SIGCOMM 2005 Workshops: Conference on Computer Communications
Country/TerritoryUnited States
CityPhiladelphia, PA

All Science Journal Classification (ASJC) codes

  • General Engineering
  • Computer Science Applications


  • Anomaly Detection
  • Instance-Based Learning
  • Wavelets


Dive into the research topics of 'Learning-based anomaly detection in BGP updates'. Together they form a unique fingerprint.

Cite this