This document summarizes a talk on RTBADT, a real-time BGP anomaly detection tool. It discusses how BGP traffic characteristics can indicate anomalies through recurrent patterns, and how recurrence quantification analysis (RQA) is applied to BGP data to detect deviations from normal behavior that may indicate disruptive events. The RTBADT software implements this approach of applying RQA to BGP updates to enable real-time anomaly detection and notification. An example of using RTBADT to monitor a peer autonomous system is also provided.

1. APNIC2018
Real-Time BGP Anomaly
Detection Tool (RTBADT)
Associate Professor Philip Branch

2. Faculty of Science, Engineering and Technology
Outline of Talk
• Project overview
• Border Gateway Protocol (BGP)
• Characteristics of BGP Traffic
• Recurrence Quantification Analysis (RQA)
• Using RQA to detect BGP anomalies
• Real-Time Detection of anomalies using RTBADT

3. Faculty of Science, Engineering and Technology
Project Overview
• RTBADT came out of Dr Bahaa Al-Musawi’s research work for
his PhD
• Was interested in detecting disruptive behaviour of BGP
nodes
• Made use of a technique from non-linear time series analysis
called Recurrence Quantification Analysis
• RTBADT is a software implementation of his research
• Available at
http://caia.swin.edu.au/tools/bgp/brt/downloads.html
• Approach is lightweight and easy to implement

4. Faculty of Science, Engineering and Technology
The Border Gateway Protocol (BGP)
• A routing protocol for reachability information between
Autonomous Systems (AS)
• A path vector protocol
• BGP Speakers
• BGP Peers
• Very few defensive mechanisms
• Events are rare but can be very damaging when they occur
8-4

5. Faculty of Science, Engineering and Technology
BGP Traffic Characteristics
• BGP generates much traffic than would be expected
• BGP events should be directly related to some change in the
underlying topology or network engineering decision
• Most BGP traffic unrelated to such events
• BGP traffic dominated by an announcement followed soon
after by a withdrawal
• No single cause
• Overlapping addresses, interaction of timer flags…
• Some early studies (1990s) suggested more than 90% of BGP
traffic is of this type

6. Faculty of Science, Engineering and Technology
BGP Traffic Characteristics

7. Faculty of Science, Engineering and Technology
BGP Anomaly Detection
• If most traffic is unrelated to topology changes or network
engineering, what then is a BGP anomaly?
• In this sense, the vast majority of BGP traffic is ‘anomalous’
• How then to determine what is anomalous?
• Why might we want to detect BGP anomalies
• BGP failures are rare but tend to be devastating when they occur
• TMNet event, Moscow Blackout, DoDo Telstra, Pakistan
YouTube hijack…
• Rapid identification of changes traffic behaviour an indicator of
a serious event

8. Faculty of Science, Engineering and Technology
BGP Anomaly Detection
• BGP Traffic does have some structure
• It is not ‘noise’ in the traditional sense of the word
• That structure can be used to identify true anomalies that may indicate
a destructive event
• BGP background traffic is persistent
• Our analysis shows that some AS have generated the same
sequences of announcement and withdrawal for years
• BGP background traffic is recurrent
• The patterns of announcements and withdrawals recur
• Our analysis shows it consists of unsynchronised announcements and
withdrawals of different periods

9. Faculty of Science, Engineering and Technology
Recurrence Quantification Analysis
• Systems where there is some recurring
sequence of events can be analysed
using Recurrence Quantification
Analysis (RQA)
• RQA models a system as having a
trajectory through a multidimensional
phase space
• Can obtain some measure of the
extent to which a system state recurs
• Large number of metrics including
• Recurrence Rate
• Determinism
• Entropy
• Trapping Time
From mathworks.com

10. Faculty of Science, Engineering and Technology
Applying RQA to BGP
• BGP is well modelled using
RQA
• Update volumes and path
lengths have a recurrent pattern
• Path announcements and
withdrawals also usually have
(perhaps several) recurrent
sequences.
• This behaviour can be captured
using RQA
• Deviations from it probably
indicate some disruptive event

11. Faculty of Science, Engineering and Technology
Applying RQA to BGP
• RQA is based on
measuring structures within
a Recurrence Plot (RP)
• An RP captures the
recurring behaviour of a
system
• Shown is an RP for top ten
noisy Autonomous Systems
• (from Al-Musawi, Branch, Armitage “Detecting
BGP Instability using Recurrence Quantification
Analysis (RQA), IPCC, December 2016

12. Faculty of Science, Engineering and Technology
Real Time BGP Anomaly Detection Tool
• Implemented these ideas in software
• Real-Time BGP Anomaly Detection Tool (RTBADT)
• http://caia.swin.edu.au/tools/bgp/brt/downloads.html
• A system made up of scripts and modules to extract RQA
measurements and present them in graphical or text form

13. Faculty of Science, Engineering and Technology
Real Time BGP Anomaly Detection Tool
• Perl, bash, gnuplot
• Uses the TISEAN package for RQA routines
• TISEAN = “Non Linear Time Series Analysis”
• Takes as input BGP updates from BGP speaker
• Includes email notification capabilities
• Lots of options
• Can scan peer Autonomous System or Systems
• Can replay events
• Can present in graphical or text

14. Faculty of Science, Engineering and Technology
Real Time BGP Anomaly Detection Tool
• A simple example of using RTBADT to monitor the peer
AS65002
• Enables the options of sending an e-mail notification when an
anomaly is detected and enabling a real-time plot of BGP
features and alarm detection
• Very light weight and easy to use

15. Faculty of Science, Engineering and Technology
Example

16. Faculty of Science, Engineering and Technology
Conclusion
• Developed software that implements some of our research
work in applying RQA to BGP
• Can replay events
• Can display RQA measurements in graphical or text form

17. Faculty of Science, Engineering and Technology
Acknowledgment
We gratefully acknowledge support from the “APNIC Internet
Operations Research Grant“ under the ISIF Asia 2016 grant
scheme