GAN-based AI Framework for detecting Ransomware Attacks Through BGP Routing Anomalies

Border Gateway Protocol (BGP) is routing protocol that plays a very important role in routing information among autonomous systems (ASes) worldwide in the Internet. Nevertheless, it does not have any security features, and thus it is prone to cyber-attacks such as ransomware, where attackers utilize BGP anomalies to launch malicious practices. To mitigate this drawback of the impossibility to follow the dynamic nature of BGP and to identify advanced cyber-threats, the study presents an AI-based Generative Adversarial Networks (GANs). The given model of unsupervised learning aims to detect anomalies when receiving BGP traffic without training on the use of specific attacks. First, the data provided by the RIPE RIS BGP is reduced in dimensionality using Principal Component Analysis (PCA) and the most important characteristics such as variability of the AS path and the prefix flaps are identified. The GAN only learns normal BGP patterns in order to identify unusual anomalies, and eventually a Random Forest (RF) classifier is used with labeled threat intelligence to identify what the anomalous actions are related to e.g. a ransomware instance. The proposed system provides a detection rate of 94.7% from the related BGP anomalies to ransomware of cyber threats against modern Internet infrastructure.