Route Anomaly Detection System for BGP Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Border Gateway Protocol (BGP) lacks effective mechanisms for detecting and remediating route anomalies such as hijacks, leaks, and withdrawals, leading to network outages and service disruptions.
Innovation Solution
A route anomaly detection and remediation system (RADAR) that performs prefix analysis on routing prefixes to identify unhealthy routes, generates validation scores, and alerts a fault alerting system to remove anomalous routes from the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If router configuration is used to prevent invalid route advertisement, then route security is improved, but device complexity and time consumption increase significantly
Solution Approach 1:
The patent introduces a route validation server as an intermediary component that receives route advertisements from BGP routers, validates them against a database of legitimate routes, and either accepts or rejects them. This mediator approach transfers the validation burden from individual router configurations to a centralized service, reducing router complexity while maintaining security.
Solution Approach 2:
The system performs preliminary validation of route advertisements before they are fully propagated across the network. By checking routes against a pre-populated database of legitimate route prefixes and origin ASes, the system prevents invalid routes from entering the network in the first place, rather than relying on post-detection remediation.
2Measurement precision
If comprehensive route validation is implemented, then detection precision of route anomalies is improved, but processing time and system complexity increase
Solution Approach 1:
The validation server implements a two-stage validation process: first performing quick checks against essential criteria (legitimate origin AS, valid prefix format), and only performing more intensive validation on routes that fail initial checks. This partial action approach maintains high detection precision while reducing average processing time for legitimate routes.
Solution Approach 2:
The system pre-loads databases of legitimate route prefixes, origin autonomous systems, and routing policies before validation operations begin. This preliminary preparation enables fast in-memory lookups during actual route validation, significantly reducing processing time compared to real-time database queries.
3Reliability
If manual router configuration is used to prevent route anomalies, then route security is improved, but productivity and scalability deteriorate
Solution Approach 1:
The validation server automatically receives BGP route advertisements, independently validates them against the database, and makes accept/reject decisions without human intervention. This self-service automation eliminates manual configuration efforts and enables the system to scale to handle thousands of routes and multiple routers simultaneously.
Solution Approach 2:
The centralized validation server provides a universal solution that can serve multiple BGP routers with different configuration requirements. A single validation instance handles route validation for the entire network, replacing the need for each router to have individual security configurations, thereby improving productivity and scalability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A route anomaly detection and remediation system analyzes a prefix for each route received to validate the route. A route monitoring component provides a centralized querying system for all routers from all devices to study routing history. A route collection component receives and stores all routes from multiple routers at a server. A set of microservice analysis components performs prefix analysis on each received route. Each microservice analysis component analyzes one or more portions of the prefix for each route to detect hijacked routes, leaked routes, withdrawn routes and/or other unhealthy routes before the routes are utilized for routing traffic on the network. The analysis performs new prefix validation and identifies healthy routes. Alerts identifying invalid routes are transmitted to an incident management system. Healthy routes are approved for usage by routers on the network to prevent network outages while improving network reliability, availability and stability.