BGP Routing Anomaly Detection Using Network Representation Learning

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The Border Gateway Protocol (BGP) lacks security mechanisms to identify and filter abnormal routing announcements, leading to issues such as prefix hijacking and route leakage, which can cause denial of service, interception, and damage to Internet operations.

Innovation Solution

An inter-domain routing anomaly detection method based on network representation learning, involving network graph construction, feature vector optimization, real-time monitoring of routing changes, and calculation of path difference values to detect abnormal routing changes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If BGP protocol is used for inter-domain routing, then routing information exchange between autonomous systems is standardized and widely deployed, but the protocol lacks security mechanisms to identify and filter abnormal routing announcements

Engineering Contradiction:

Improverouting information exchange capabilityVSAvoidrouting announcement security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs offline network representation learning to pre-train a detection model on historical routing data and AS relationship graphs. This preliminary action prepares the model with prior knowledge of normal routing patterns and autonomous system relationships before real-time deployment, enabling it to quickly identify abnormal routing announcements without disrupting live BGP operations

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary detection system that sits between BGP routing announcements and the routing table. This intermediary uses the trained detection model to analyze routing updates, calculate path difference values, and filter abnormal announcements before they can cause harm, while allowing legitimate BGP operations to proceed unchanged

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If real-time monitoring of routing changes is implemented, then abnormal routing changes can be detected promptly, but detection precision and false alarm reduction are challenging

Engineering Contradiction:

Improvereal-time detection speedVSAvoidrouting anomaly detection accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system implements feedback through the detection model that continuously learns from detected routing anomalies and adjusts its detection thresholds. The model uses the pre-trained AS relationship representations to provide contextual feedback when evaluating routing changes, comparing detected anomalies against established patterns of legitimate routing behavior to reduce false alarms while maintaining high detection accuracy

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent changes the parameter space by transforming raw routing data into network representation vectors through offline learning. This parameter transformation enables the system to detect anomalies in a higher-dimensional feature space where normal and abnormal routing patterns are more distinguishable, improving detection precision without sacrificing real-time performance

Inventive Principle:

Principle #35Parameter changes

3Measurement precision

If path difference calculation is used to identify abnormal routing changes, then routing anomalies can be accurately identified, but computational complexity increases

Engineering Contradiction:

Improverouting anomaly identification accuracyVSAvoiddetection system computational complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system pre-calculates and stores network representation vectors for all autonomous systems during offline training, including their structural features and relationship characteristics. This preliminary computation eliminates the need for complex real-time calculations when detecting anomalies, as the system only needs to compare current routing paths against pre-computed representations, significantly reducing online computational complexity

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent extracts only the essential features needed for anomaly detection from the full BGP routing data, such as AS path sequences and key routing attributes. By extracting and focusing on these critical elements rather than processing complete routing tables, the system achieves high detection accuracy with reduced computational complexity

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS20250350631A1Inter-Domain Routing Anomaly Detection Method Based on Network Representation Learning

Publication Date: 2025.11.13 CHINA TELECOM CYBERSECURITY TECHNOLOGY CO LTD

AI summary

An inter-domain routing anomaly detection method based on network representation learning, comprises: performing network representation learning of Internet autonomous system relationships under an offline condition; monitoring a routing change of a plurality of inter-domain routing vantage points in real time, updating global routing in response to receiving a border gateway protocol update message, and recording a routing change when the routing change is detected; in response to detecting the routing change, calculating a path difference value before and after the routing change, and when the path difference value is greater than a threshold, determining that the routing change is an abnormal routing change; and performing attribution on the abnormal routing change, aggregating the abnormal routing change into an abnormal event, and issuing an alarm.