Suitability of Graph Representation for BGP Anomaly Detection - Archive ouverte HAL Access content directly
Conference Papers Year :

Suitability of Graph Representation for BGP Anomaly Detection


The Border Gateway Protocol (BGP) is in charge of the route exchange at the Internet scale. Anomalies in BGP can have several causes (mis-configuration, outage and attacks). These anomalies are classified into large or small scale anomalies. Machine learning models are used to analyze and detect anomalies from the complex data extracted from BGP behavior. Two types of data representation can be used inside the machine learning models: a graph representation of the network (graph features) or a statistical computation on the data (statistical features). In this paper, we evaluate and compare the accuracy of machine learning models using graph features and statistical features on both large and small scale BGP anomalies. We show that statistical features have better accuracy for large scale anomalies, and graph features increase the detection accuracy by 15% for small scale anomalies and are well suited for BGP small scale anomaly detection.
Fichier principal
Vignette du fichier
Suitability.pdf (324.38 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03398624 , version 1 (23-10-2021)



Kevin Hoarau, Pierre Ugo Tournoux, Tahiry Razafindralambo. Suitability of Graph Representation for BGP Anomaly Detection. 2021 IEEE 46th Conference on Local Computer Networks (LCN), Oct 2021, Edmonton, Canada. pp.305-310, ⟨10.1109/LCN52139.2021.9524941⟩. ⟨hal-03398624⟩
52 View
205 Download



Gmail Facebook Twitter LinkedIn More