Detecting BGP anomalies with wavelet

Mai, Jianning; Yuan, Lihua; Chuah, Chen‐Nee

doi:10.1109/noms.2008.4575169

Cited by 17 publications

(8 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A number of related studies have been carried out on the detection of anomalies in IRS [13]. In terms of time series analysis, Mai et al [14] and Prakash et al [15] used wavelet analysis to analyze and detect BGP anomalies. Deshpande et al [16] proposed an online BGP anomaly detection method that uses a generalized maximum likelihood ratio to compare real-time sequences with predicted results of the AR model to detect mutation points.…”

Section: Related Workmentioning

confidence: 99%

SM-RC: A New Security Measurement Method for Inter-Domain Routing System

et al. 2019

View full text Add to dashboard Cite

Inter-domain routing system (IRS) is the key infrastructure of the Internet. It is of great significance to perceive and identify the security threats of IRS for the stable operation of the Internet. Security quantification is an important part of security threat perception. The existing methods are unable to construct accurate abnormal state quantitative models because of limited data. Therefore, only the similarity between the current state and the normal state of IRC can be considered, and the types of security threats cannot be distinguished. Aiming at the above problems, this paper proposes a security measurement method based on the abnormal state modeling. By analyzing the security indicators, when IRS suffering from security events and extracting the common characteristics of the abnormal state, a qualitative model of IRS's abnormal state is established. Thus, the similarity between the current state and the specific abnormal state has been taken into consideration in measuring the security of IRS. Experiments based on SMW-4 cable fault event and Malaysian route leak event show that the highest detection and classification precision of the former are both 100%, and the highest detection and classification precision of the latter is 96% and 95.8%, respectively, which proves that the measurement results can indicate the occurrence of security threats and their types.INDEX TERMS Inter-domain routing system, security measurement, abnormal state modeling, anomaly classification, ideal point.

show abstract

Section: Related Workmentioning

confidence: 99%

SM-RC: A New Security Measurement Method for Inter-Domain Routing System

et al. 2019

View full text Add to dashboard Cite

show abstract

“…Among all these work [36] used Fourier analysis tools to analyze routing update rates and to relate them to BGP anomalies. Mei et al developed BAlet, a wavelet based approach that cluster fast changing BGP feeds to identify possible source of large-scale anomalies [46]. Wavelet Transforms were also used in the BGP-lens [53] to analyze the rate of updates of per prefix.…”

Section: Related Workmentioning

confidence: 99%

A Geometric Approach for Real-time Monitoring of Dynamic Large Scale Graphs: AS-level graphs illustrated

Salamatian,

Kaafar,

Salamatian

2018

Preprint

View full text Add to dashboard Cite

The monitoring of large dynamic networks is a major challenge for a wide range of application. The complexity stems from properties of the underlying graphs, in which slight local changes can lead to sizable variations of global properties, e.g., under certain conditions, a single link cut that may be overlooked during monitoring can result in splitting the graph into two disconnected components. Moreover, it is often difficult to determine whether a change will propagate globally or remain local. Traditional graph theory measure such as the centrality or the assortativity of the graph are not satisfying to characterize global properties of the graph. In this paper, we tackle the problem of real-time monitoring of dynamic large scale graphs by developing a geometric approach that leverages notions of geometric curvature and recent development in graph embeddings using Ollivier-Ricci curvature [47]. We illustrate the use of our method by considering the practical case of monitoring dynamic variations of global Internet using topology changes information provided by combining several BGP feeds. In particular, we use our method to detect major events and changes via the geometry of the embedding of the graph.We first adapt the Ricci curvature to characterize the AS level graph. The key idea is to detect changes in between consecutive snapshots and to separate events that result in considerable geometric alterations, from those that remain local. The variations of curvature are evaluated through a set of landmarks as reference points. We develop an anomaly tracking mechanism to detect large variations of curvature that translate into major variations in the geometry of the graph. These changes are then considered as major BGP level events. In a second stage, we describe a mechanism for identifying the network elements responsible for the set of coordinated changes and isolate their geometric implications. We evaluate this system in operational settings and show its performance in real-life scenarios.

show abstract

“…Prakash et al developed BGPlens, which monitors anomalies by observing statistical anomalies in BGP updates based on analysis of several features, including selfsimilarity, power-law, and lognormal marginals [28]. Similarly, Mai [26], Zhang [40] and Al-Rousan [3] have examined BGP update messages using tools based on self-similarity and wavelets analysis hidden Markov models to design anomaly detection mechanisms.…”

Section: Related Workmentioning

confidence: 99%

ASwatch

Konte

Perdisci

Feamster

2015

Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication

View full text Add to dashboard Cite

Bulletproof hosting Autonomous Systems (ASes)-malicious ASes fully dedicated to supporting cybercrime-provide freedom and resources for a cyber-criminal to operate. Their services include hosting a wide range of illegal content, botnet C&C servers, and other malicious resources. Thousands of new ASes are registered every year, many of which are often used exclusively to facilitate cybercrime. A natural approach to squelching bulletproof hosting ASes is to develop a reputation system that can identify them for takedown by law enforcement and as input to other attack detection systems (e.g., spam filters, botnet detection systems). Unfortunately, current AS reputation systems rely primarily on data-plane monitoring of malicious activity from IP addresses (and thus can only detect malicious ASes after attacks are underway), and are not able to distinguish between malicious and legitimate but abused ASes.

show abstract

Detecting BGP anomalies with wavelet

Cited by 17 publications

References 21 publications

SM-RC: A New Security Measurement Method for Inter-Domain Routing System

SM-RC: A New Security Measurement Method for Inter-Domain Routing System

A Geometric Approach for Real-time Monitoring of Dynamic Large Scale Graphs: AS-level graphs illustrated

ASwatch

Contact Info

Product

Resources

About