BGPFlow: Flow-based Feature Extraction for BGP Anomaly Detection

The Border Gateway Protocol (BGP) plays a pivotal role in inter-domain routing, but its decentralized nature and lack of inherent security make it vulnerable to various anomalies. Efficient detection of these anomalies relies on appropriate aggregation methods that extract both quantitative and topological features from routing updates. However, due to the immense scale and complexity of the Internet, inappropriate feature aggregation methods may introduce data noise, thereby increasing detection latency and degrading the overall accuracy of the system. In this paper, we propose BGPFlow, a flexible and scalable feature extraction framework that supports multiple levels of aggregation and integrates both quantitative and graph-based features. We organize the BGP feature flows using the Original Autonomous System (Original AS) as the key and performs aggregation at the country level. To reduce the computational complexity of graph-based features, we apply a graph clustering method based on Graph Autoencoder (GAE) to compress country-level BGP topologies, preserving structural semantics while enhancing the detection of both large-scale and smaller anomalies. Through case studies involving routing anomalies of various scales, we demonstrate the efficiency of BGPFlow in detecting real-world network incidents.