Detecting forged AS paths from BGP graph features using Recurrent Neural Networks

Overview & Synopsis

The Border Gateway Protocol (BGP) is in charge of the route exchange at the Internet scale. Anomalies in BGP can have several causes (misconfigurations, outages and attacks). Forged AS paths are small scale and subtle attacks on BGP and therefore are hard to detect. In this paper we use a Machine Learning (ML) model applying a Long Short-Term Memory (LSTM) based Recurrent Neural Network (RNN) architecture to take the temporal aspect of BGP into account. We show that our ML model is able to detect forged AS path anomalies with an accuracy of 67% and a precision of 72%. These preliminary results outperform the existing proposals and allow us to think that ML on temporal graphs is worth investigating.