A Multi-View Framework for BGP Anomaly Detection via Graph Attention Network
This work addresses the problem of detecting Internet anomalies for network security and stability, representing a strong specific gain in the domain.
The paper tackles BGP anomaly detection by proposing a multi-view model using STL for noise reduction and Graph Attention Network to capture feature relationships and time correlations, achieving state-of-the-art results with average F1 scores of 96.3% and 93.2% on balanced and imbalanced datasets.
As the default protocol for exchanging routing reachability information on the Internet, the abnormal behavior in traffic of Border Gateway Protocols (BGP) is closely related to Internet anomaly events. The BGP anomalous detection model ensures stable routing services on the Internet through its real-time monitoring and alerting capabilities. Previous studies either focused on the feature selection problem or the memory characteristic in data, while ignoring the relationship between features and the precise time correlation in feature (whether it's long or short term dependence). In this paper, we propose a multi-view model for capturing anomalous behaviors from BGP update traffic, in which Seasonal and Trend decomposition using Loess (STL) method is used to reduce the noise in the original time-series data, and Graph Attention Network (GAT) is used to discover feature relationships and time correlations in feature, respectively. Our results outperform the state-of-the-art methods at the anomaly detection task, with the average F1 score up to 96.3% and 93.2% on the balanced and imbalanced datasets respectively. Meanwhile, our model can be extended to classify multiple anomalous and to detect unknown events.