Sparse Control and Data plane Telemetry features for BGP anomaly detection

Nowadays, the paradigm of detection of anomalous behavior in data networks is changing with the availability of data of high dimension and resolution, i.e. telemetry data. However, using such data requires careful analysis to decide which features are actually important for operators. In this paper we propose Sparse-RFE, a learning-based process that constructs a very small subset of telemetry features suitable for detection tasks. We apply Sparse-RFE on monitoring data of a BGP data center network described by a large amount of YANG instances. Our results show that collecting such subset of features from 1/3 of the nodes in the network results in instantiating only about 5% of the original features. Detectors based on Sparse-RFE features achieve high detection performance comparable to detectors that need all data from every node.