A deep learning framework for BGP anomaly detection and classification
The Border Gateway Protocol (BGP) is the default Internet routing protocol that manages connectivity among Autonomous Systems (ASes). Although BGP disruptions are rare when they occur the consequences can be very damaging. Consequently, there has been a considerable effort aimed at understanding wha...
| Autor principal: | Fonseca, Paulo César da Rocha |
|---|---|
| Outros Autores: | http://lattes.cnpq.br/3639575844521754, https://orcid.org/0000-0003-4641-6098 |
| Grau: | Tese |
| Idioma: | eng |
| Publicado em: |
Universidade Federal do Amazonas
2020
|
| Assuntos: | |
| Acesso em linha: |
https://tede.ufam.edu.br/handle/tede/7700 |
| id |
oai:https:--tede.ufam.edu.br-handle-:tede-7700 |
|---|---|
| recordtype |
dspace |
| spelling |
oai:https:--tede.ufam.edu.br-handle-:tede-77002020-03-05T05:03:55Z A deep learning framework for BGP anomaly detection and classification Fonseca, Paulo César da Rocha Mota, Edjard Souza http://lattes.cnpq.br/3639575844521754 http://lattes.cnpq.br/0757666181169076 Feitosa, Eduardo Luzeiro http://lattes.cnpq.br/5939944067207881 Carvalho, André Luiz da Costa http://lattes.cnpq.br/4863447798119856 Souza, Jose Neuman de http://lattes.cnpq.br/3614256141054800 https://orcid.org/0000-0003-4641-6098 Border Gateway Protocol Machine Learning Dataset generation Autonomous Systems Anomalias BGP CIÊNCIAS EXATAS E DA TERRA: CIÊNCIA DA COMPUTAÇÃO Border Gateway Protocol Anomaly detection Machine Learning Dataset generation Detecção de anomalias The Border Gateway Protocol (BGP) is the default Internet routing protocol that manages connectivity among Autonomous Systems (ASes). Although BGP disruptions are rare when they occur the consequences can be very damaging. Consequently, there has been a considerable effort aimed at understanding what is normal and abnormal BGP traffic and, in so doing, enable potentially disruptive anomalous traffic to be identified quickly. Even though there is an extensive research on anomaly detection, there are two major gaps in current literature: the scarcity of public datasets for all types of events and the lack of a BGP anomaly classification framework that differentiates anomaly classes. Since that there are no public datasets of labeled BGP anomalous events, each model was validated using different datasets, which had to be individually generated for each approach. The absence of common groundwork dataset increases the difficulty in comparing different approaches. The lack of a classification framework hinders the deployment of specific mitigation measures to each anomaly class in an automated fashion. In the current work, we address both problems: 1) We provide a BGP dataset generation tool and publicly available datasets for different anomaly classes. These datasets contain the most used features by previous research efforts and additional novel features; 2) We address the BGP anomaly classification problem by developing a framework that uses deep learning as the core engine of an anomaly detection and classification mechanism. We built a model that exploits different neural network architectures advantages. Both novel features and the BGP anomaly detector and classifier were evaluated and it was demonstrated that they can be used to react to anomalies in real-time and leverage the deployment of different mitigation and coordination strategies to different anomaly classes in an autonomous fashion. The Border Gateway Protocol (BGP) is the default Internet routing protocol that manages connectivity among Autonomous Systems (ASes). Although BGP disruptions are rare when they occur the consequences can be very damaging. Consequently, there has been a considerable effort aimed at understanding what is normal and abnormal BGP traffic and, in so doing, enable potentially disruptive anomalous traffic to be identified quickly. Even though there is an extensive research on anomaly detection, there are two major gaps in current literature: the scarcity of public datasets for all types of events and the lack of a BGP anomaly classification framework that differentiates anomaly classes. Since that there are no public datasets of labeled BGP anomalous events, each model was validated using different datasets, which had to be individually generated for each approach. The absence of common groundwork dataset increases the difficulty in comparing different approaches. The lack of a classification framework hinders the deployment of specific mitigation measures to each anomaly class in an automated fashion. In the current work, we address both problems: 1) We provide a BGP dataset generation tool and publicly available datasets for different anomaly classes. These datasets contain the most used features by previous research efforts and additional novel features; 2) We address the BGP anomaly classification problem by developing a framework that uses deep learning as the core engine of an anomaly detection and classification mechanism. We built a model that exploits different neural network architectures advantages. Both novel features and the BGP anomaly detector and classifier were evaluated and it was demonstrated that they can be used to react to anomalies in real-time and leverage the deployment of different mitigation and coordination strategies to different anomaly classes in an autonomous fashion. Fundação de Amparo à Pesquisa do Estado do Amazonas - FAPEAM 2020-03-04T20:03:43Z 2019-11-18 Tese FONSECA, Paulo César da Rocha. A deep learning framework for BGP anomaly detection and classification. 2019. 117 f. Tese (Doutorado em Informática) - Universidade Federal do Amazonas, Manaus, 2019. https://tede.ufam.edu.br/handle/tede/7700 eng Acesso Aberto http://creativecommons.org/licenses/by/4.0/ application/pdf Universidade Federal do Amazonas Instituto de Computação Brasil UFAM Programa de Pós-graduação em Informática |
| institution |
TEDE - Universidade Federal do Amazonas |
| collection |
TEDE-UFAM |
| language |
eng |
| topic |
Border Gateway Protocol Machine Learning Dataset generation Autonomous Systems Anomalias BGP CIÊNCIAS EXATAS E DA TERRA: CIÊNCIA DA COMPUTAÇÃO Border Gateway Protocol Anomaly detection Machine Learning Dataset generation Detecção de anomalias |
| spellingShingle |
Border Gateway Protocol Machine Learning Dataset generation Autonomous Systems Anomalias BGP CIÊNCIAS EXATAS E DA TERRA: CIÊNCIA DA COMPUTAÇÃO Border Gateway Protocol Anomaly detection Machine Learning Dataset generation Detecção de anomalias Fonseca, Paulo César da Rocha A deep learning framework for BGP anomaly detection and classification |
| topic_facet |
Border Gateway Protocol Machine Learning Dataset generation Autonomous Systems Anomalias BGP CIÊNCIAS EXATAS E DA TERRA: CIÊNCIA DA COMPUTAÇÃO Border Gateway Protocol Anomaly detection Machine Learning Dataset generation Detecção de anomalias |
| description |
The Border Gateway Protocol (BGP) is the default Internet routing protocol that manages connectivity among Autonomous Systems (ASes). Although BGP disruptions are rare when they occur the consequences can be very damaging. Consequently, there has been a considerable effort aimed at understanding what is normal and abnormal BGP traffic and, in so doing, enable potentially disruptive anomalous traffic to be identified quickly. Even though there is an extensive research on anomaly detection, there are two major gaps in current literature: the scarcity of public datasets for all types of events and the lack of a BGP anomaly classification framework that differentiates anomaly classes. Since that there are no public datasets of labeled BGP anomalous events, each model was validated using different datasets, which had to be individually generated for each approach. The absence of common groundwork dataset increases the difficulty in comparing different approaches. The lack of a classification framework hinders the deployment of specific mitigation measures to each anomaly class in an automated fashion. In the current work, we address both problems: 1) We provide a BGP dataset generation tool and publicly available datasets for different anomaly classes. These datasets contain the most used features by previous research efforts and additional novel features; 2) We address the BGP anomaly classification problem by developing a framework that uses deep learning as the core engine of an anomaly detection and classification mechanism. We built a model that exploits different neural network architectures advantages. Both novel features and the BGP anomaly detector and classifier were evaluated and it was demonstrated that they can be used to react to anomalies in real-time and leverage the deployment of different mitigation and coordination strategies to different anomaly classes in an autonomous fashion. |
| author_additional |
Mota, Edjard Souza |
| author_additionalStr |
Mota, Edjard Souza |
| format |
Tese |
| author |
Fonseca, Paulo César da Rocha |
| author2 |
http://lattes.cnpq.br/3639575844521754 https://orcid.org/0000-0003-4641-6098 |
| author2Str |
http://lattes.cnpq.br/3639575844521754 https://orcid.org/0000-0003-4641-6098 |
| title |
A deep learning framework for BGP anomaly detection and classification |
| title_short |
A deep learning framework for BGP anomaly detection and classification |
| title_full |
A deep learning framework for BGP anomaly detection and classification |
| title_fullStr |
A deep learning framework for BGP anomaly detection and classification |
| title_full_unstemmed |
A deep learning framework for BGP anomaly detection and classification |
| title_sort |
deep learning framework for bgp anomaly detection and classification |
| publisher |
Universidade Federal do Amazonas |
| publishDate |
2020 |
| url |
https://tede.ufam.edu.br/handle/tede/7700 |
| _version_ |
1831969854517673984 |
| score |
11.753735 |