Detection of BGP Hijacking based on AS Hegemony

Spoofing of Border Gateway Protocol (BGP) messages advertised by autonomous systems (ASes), or the advertisement of incorrect AS paths due to AS failure or misconfiguration is known as BGP hijacking, which causes delays and instability in overall the Internet communications. To prevent this, AS hegemonies, which are health indicators for each AS, are published. However, the AS hegemony is not constant even under normal conditions, and no mechanism has yet been proposed to detect anomalies. Therefore, we have been studying methods to detect anomalies in the AS hegemony. In this study, we propose to detect anomalies by having the convolutional autoencoder (AE) learn the first-order difference values of time-series data of AS hegemonies under normal conditions. As a validation case study, we report that good accuracy was achieved in detecting anomalies in the AS hegemony of the Level 3 parent, LCC (Level 3) and surrounding ASes in an incident caused by Level 3.