BGP AS-Path Anomaly Detection for Route Spoofing and Leaks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large computer networks face issues with routing anomalies such as unauthorized route spoofing and route leaking, which compromise the integrity of route advertisements and can lead to unauthorized data propagation.
Innovation Solution
A routing anomaly detection system that utilizes Border Gateway Protocol (BGP) advertisements to analyze AS paths for anomalies by normalizing BGP message data, comparing it to expected prefixes, and performing evaluations to detect spoofing attempts, route leaks, and other irregularities, with the ability to output alerts and perform mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If BGP advertisements are propagated across the network to enable routing, then network connectivity and data propagation are improved, but routing anomalies such as unauthorized route spoofing and route leaking can occur, compromising network integrity
Solution Approach 1:
The system continuously monitors BGP advertisements and provides feedback by comparing actual advertisements against expected routing policies. When anomalies are detected, the system generates alerts and can automatically respond by withdrawing suspicious routes, creating a closed-loop control system that maintains network integrity while allowing normal routing operations
Solution Approach 2:
The patent introduces an intermediary anomaly detection system that sits between BGP speakers and the rest of the network. This intermediary normalizes and validates BGP advertisements before they propagate, acting as a gatekeeper that filters out unauthorized route advertisements while allowing legitimate routing information to pass through
2Reliability
If routing anomaly detection and mitigation actions are implemented, then network integrity is improved, but system complexity increases due to additional monitoring and validation mechanisms
Solution Approach 1:
The anomaly detection system is designed to perform multiple functions: it normalizes BGP advertisements, validates routing policies, detects various types of anomalies (spoofing, route leaking, hijacking), generates alerts, and can automatically respond. This multi-functional approach consolidates what could be multiple separate systems into a single unified platform, managing complexity while comprehensive protection
3Measurement precision
If comprehensive BGP advertisement monitoring is performed to detect all routing anomalies, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary normalization of BGP advertisements as they arrive, establishing a baseline of expected routing behavior in advance. By pre-processing and standardizing the data format, the system reduces the computational burden during actual anomaly detection, enabling comprehensive monitoring without excessive processing delays
Solution Approach 2:
The detection process is segmented into distinct stages: normalization, validation against routing policies, anomaly detection, and response. This segmentation allows the system to process different aspects of BGP advertisements in parallel and focus computational resources on the most critical validation steps, improving both accuracy and efficiency
Data Source
AI summary
In a computer networking system, data is transmitted through a network based on advertised routes. The disclosure provides mechanisms for detecting anomalies in network routing by analyzing autonomous system (AS) paths in data corresponding to Border Gateway Protocol (BPG) messages. The AS path information from the BGP message data may be evaluated to detect different types of anomalies, which may be reported to a management entity for further review or mitigation.