Comparing machine learning algorithms for BGP anomaly detection using graph features

Sanchez, Odnan Ref;Ferlin, Simone;Pelsser, Cristel;Bush, Randy
(2019) Big-DAMA ’19: Proceedings of the 3rd ACM CoNEXT Workshop on Big DAta, Machine Learning and Artificial Intelligence for Data Comm — Location: Orlando FL USA (9.December.2019)

Files

Pelsser_ICTM16.pdf
  • Open Access
  • Adobe PDF
  • 1.04 MB
Download

Details

Authors
  • Sanchez, Odnan Ref
    Author
  • Ferlin, Simone
    Author
  • Pelsser, Cristelorcid-logoUCLouvain
    Author
  • Bush, Randy
    Author
Abstract
The Border Gateway Protocol (BGP) coordinates the connectivity and reachability among Autonomous Systems, providing efficient operation of the global Internet. Historically, BGP anomalies have disrupted network connections on a global scale, i.e., detecting them is of great importance. Today, Machine Learning (ML) methods have improved BGP anomaly detection using volume and path features of BGP's update messages, which are often noisy and bursty. In this work, we identified different graph features to detect BGP anomalies, which are arguably more robust than traditional features. We evaluate such features through an extensive comparison of different ML algorithms, i.e., Naive Bayes classifier (NB), Decision Trees (DT), Random Forests (RF), Support Vector Machines (SVM), and Multi-Layer Perceptron (MLP), to specifically detect BGP path leaks. We show that SVM offers a good trade-off between precision and recall. Finally, we provide insights into the graph features' characteristics during the anomalous and non-anomalous interval and provide an interpretation of the ML classifier results.
Affiliations

Citations

  • APA
  • Chicago
  • FWB

Sanchez, O. R., Ferlin, S., Pelsser, C., & Bush, R. (2019). Comparing machine learning algorithms for BGP anomaly detection using graph features. Big-DAMA ’19: Proceedings of the 3rd ACM CoNEXT Workshop on Big DAta, Machine Learning and Artificial Intelligence for Data Comm, Orlando FL USA. https://doi.org/10.1145/3359992.3366640