Detecting BGP Anomalies based on Spatio-Temporal Feature Representation Model for Autonomous Systems

Autonomous Systems (ASes) communicate via the Border Gateway Protocol (BGP), forming the Inter-domain routing network, the Internet’s critical infrastructure. Large-scale BGP anomalies over the years have caused serious damage to the global Internet. Effective BGP anomaly detection helps early mitigation of BGP anomalies. Methods based on machine learning, especially graph learning, have achieved remarkable results. However, existing methods based on graph learning have two limitations. One is to use AS communication graphs as the input to the graph neural network model, ignoring the interactions between AS nodes that are physically topologically connected and weakening the perception of anomalous neighbouring nodes; and the other is to use the average features of all nodes as the features of the whole network, smoothing the differences of different nodes, reducing the detection performance while failing to support anomaly tracing. We propose a BGP anomaly detection method based on the spatio-temporal feature representation model for AS (ASSTFR). The ASSTFR model is based on the Graph Attention Network (GAT) and Gated Recurrent Unit (GRU), which automatically extracts spatio-temporal features of AS nodes, rather than the whole network. We use ASSTFR to predict AS features by combining the actual topological connection of AS nodes and the historical information of AS communication features. Thus, the anomaly score of each AS can be generated based on the prediction and observation of AS features. We aggregate AS node anomaly scores based on node importance to detect BGP anomalies, which can distinguish the different contributions of different nodes to the network. The experimental results show that our method outperforms the existing methods in all metrics. Compared with the best-performing existing method, the accuracy, precision, recall, and F1-score of our method are improved by 2.7%, 3.0%, 2.3%, and 2.7% respectively. What’s more, ranking anomaly scores of AS nodes can narrow down the scope of investigation for abnormal origin AS, which helps to locate the root cause of BGP anomalies.