Suitability of Graph Representation for BGP Anomaly Detection - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

Suitability of Graph Representation for BGP Anomaly Detection

Résumé

The Border Gateway Protocol (BGP) is in charge of the route exchange at the Internet scale. Anomalies in BGP can have several causes (mis-configuration, outage and attacks). These anomalies are classified into large or small scale anomalies. Machine learning models are used to analyze and detect anomalies from the complex data extracted from BGP behavior. Two types of data representation can be used inside the machine learning models: a graph representation of the network (graph features) or a statistical computation on the data (statistical features). In this paper, we evaluate and compare the accuracy of machine learning models using graph features and statistical features on both large and small scale BGP anomalies. We show that statistical features have better accuracy for large scale anomalies, and graph features increase the detection accuracy by 15% for small scale anomalies and are well suited for BGP small scale anomaly detection.
Fichier principal
Vignette du fichier
Suitability.pdf (324.38 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03398624 , version 1 (23-10-2021)

Identifiants

Citer

Kevin Hoarau, Pierre Ugo Tournoux, Tahiry Razafindralambo. Suitability of Graph Representation for BGP Anomaly Detection. 2021 IEEE 46th Conference on Local Computer Networks (LCN), Oct 2021, Edmonton, Canada. pp.305-310, ⟨10.1109/LCN52139.2021.9524941⟩. ⟨hal-03398624⟩
58 Consultations
255 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More