Abstract: Bahaa Al-Musawi (2018)

The Border Gateway Protocol (BGP) is the Internetâ€™s default inter-domain routing protocol that manages connectivity among Autonomous Systems (ASes). BGP is an incremental pro- tocol where, after the initial transfer of a full routing table, BGP traffic to peers should only reflect underlying topology or traffic engineering changes. Unfortunately, most BGP traffic consists of announcements, updates and withdrawals unrelated to any underlying network management goals. We define such BGP traffic as unstable BGP traffic as long as it does not disseminate the business relationship between Internet Service Providers (ISPs) or threaten BGP operation. We define ASes that originate unstable BGP traffic as unstable ASes.

BGP was developed at a time when information provided by an AS was assumed to be accurate. Although many attempts have been made to improve its security, BGP is still vulnerable to different types of anomalous events. BGP anomalies are rare but can cause great damage when they occur. The consequences of these anomalies can range from a single to thousands of anomalous BGP updates. These consequences have threatened Internet performance and reliability. Identifying BGP anomalies is a challenging task where BGP traffic has been characterised to be noisy, voluminous, and complex. Furthermore, unstable BGP traffic has the effect of masking anomalous traffic.

Recent statistics and trends of BGP anomalies show approximately 20% of BGP anomalies lasted less than 10 minutes but were able to pollute 90% of the Internet in less than 2 minutes. These statistics demonstrate the need for rapid detection of BGP anomalies. Early detection of BGP anomalies enables network operators to protect their network from the worst consequence of the anomalous behaviour and helps to improve Internet stability. Current approaches tend to be slow and require substantial historical data.

To overcome these challenges, this thesis proposes a novel scheme to detect BGP anomalies based on Recurrence Quantification Analysis (RQA). RQA is an advanced non-linear statistical analysis technique using phase space concepts. RQA can identify BGP anomalies rapidly. RQA can also identify abnormal hidden behaviour in the underlying BGP traffic that may otherwise pass without observation. Using the past and emulated BGP anomalies, we demonstrate that RQA can detect BGP anomalies within 62 seconds using 1200 seconds of historical BGP updates.

The main contribution of this thesis is to demonstrate that RQA can be used to detect anomalous BGP events rapidly. We apply RQA to well known BGP events and also to controlled experiments which we carried out on our network testbed.

We also demonstrate that background BGP traffic can be well described as the aggregation of unsynchronised periodic traffic with different frequencies. This behaviour is widespread and can last for months or even years.

Finally, we model BGP speakers (a router or a device that runs BGP) as dynamic systems using the concepts of phase space trajectory. Our modelling shows that BGP speakers generate traffic that have the characteristics of being non-linear, deterministic, and stable.

Please note: The abstracts of the bibliography database may underly other copyrights.

Ihr Browser versucht gerade eine Seite aus dem sogenannten Internet auszudrucken. Das Internet ist ein weltweites Netzwerk von Computern, das den Menschen ganz neue Möglichkeiten der Kommunikation bietet.

Da Politiker im Regelfall von neuen Dingen nichts verstehen, halten wir es für notwendig, sie davor zu schützen. Dies ist im beidseitigen Interesse, da unnötige Angstzustände bei Ihnen verhindert werden, ebenso wie es uns vor profilierungs- und machtsüchtigen Politikern schützt.

Sollten Sie der Meinung sein, dass Sie diese Internetseite dennoch sehen sollten, so können Sie jederzeit durch normalen Gebrauch eines Internetbrowsers darauf zugreifen. Dazu sind aber minimale Computerkenntnisse erforderlich. Sollten Sie diese nicht haben, vergessen Sie einfach dieses Internet und lassen uns in Ruhe.

Die Umgehung dieser Ausdrucksperre ist nach §95a UrhG verboten.

Mehr Informationen unter www.politiker-stopp.de.

Detecting BGP Anomalies Using Recurrence Quantification Analysis