Improving anomaly detection in BGP time-series data by new guide features and moderated feature selection algorithm

Abstract

The Internet infrastructure relies on the Border Gateway Protocol (BGP) to provide essential routinginformation where abnormal routing behavior impairs global Internet connectivity and stability. Hence, employinganomaly detection algorithms is important for improving the performance of BGP routing protocol. In this paper, wepropose two algorithms; the first is the guide feature generator (GFG), which generates guide features from traditionalfeatures in BGP time-series data using moving regression in combination with smoothed moving average. The secondis a modified random forest feature selection algorithm which is employed to automatically select the most dominantfeatures (ASMDF). Our mechanism shows that the detected anomalies are more realistic and the selected features aregenerally consistent across time series. Experimental evaluations using multiple machine learning models reveal that theproposed algorithms achieve up to 32.36% improvement in accuracy rate, up to 35.44% reduction in false negative rate,and up to 43.99% reduction in false positive rate compared to not using these algorithms. Moreover, the ASMDF optionincreases the feature selection speed more than 3 times compared to most existing feature selection algorithms.