Anomaly detection in Border Gateway Protocol using supervised machine learning

Border Gateway Protocol (BGP) is the primary protocol used to exchange routing information between various Autonomous systems (AS) and domains. BGP can exhibit anomalous behavior due to malicious attacks, system failure, extra traffic or network operator problems. Once BGP messages with wrong information make their way into the network, it can have a cascading effect as more and more systems update their BGP records with the wrong information. These anomalies are not easily detected due to the large volume of BGP messages sent and received over the network. Typically, most autonomous systems do not confirm if a BGP update is authentic or not because of the associated cost of verifying a huge number of BGP messages, which creates the need for an alternate way of detecting BGP anomalies. This work attempts to use supervised machine learning techniques on BGP records to detect such anomalies. In this study, an SVM model and an MLP model are developed, trained, and fine-tuned to detect BGP anomalies. In the simulation, the SVM and MLP models achieve the best accuracy of 91.31% and 90.05% respectively, over a scrapped dataset.