Research Article
A Statistical Approach to Anomaly Detection in Interdomain Routing
@INPROCEEDINGS{10.1109/BROADNETS.2006.4374397, author={S. Deshpande and M. Thottan and T.K. Ho and B. Sikdar}, title={A Statistical Approach to Anomaly Detection in Interdomain Routing}, proceedings={3rd International ICST Conference on Broadband Communications, Networks, and Systems}, publisher={IEEE}, proceedings_a={BROADNETS}, year={2006}, month={10}, keywords={}, doi={10.1109/BROADNETS.2006.4374397} }- S. Deshpande
M. Thottan
T.K. Ho
B. Sikdar
Year: 2006
A Statistical Approach to Anomaly Detection in Interdomain Routing
BROADNETS
IEEE
DOI: 10.1109/BROADNETS.2006.4374397
Abstract
A number of events such as hurricanes, earthquakes, power outages can cause large-scale failures in the Internet. These in turn cause anomalies in the interdomain routing process. The policy-based nature of border gateway protocol (BGP) further aggravates the effect of these anomalies causing severe, long lasting route fluctuations. In this work we propose an architecture for anomaly detection that can be implemented on individual routers. We use statistical pattern recognition techniques for extracting meaningful features from the BGP update message data. A time-series segmentation algorithm is then carried out on the feature traces to detect the onset of an instability event The performance of the proposed algorithm is evaluated using real Internet trace data. We show that instabilities triggered by events like router mis-configurations, infrastructure failures and worm attacks can be detected with a false alarm rate as low as 0.0083 alarms per hour. We also show that our learning based mechanism is highly robust as compared to methods like exponentially weighted moving average (EWMA) based detection.