???item.export.label??? ???item.export.type.endnote??? ???item.export.type.bibtex???

Please use this identifier to cite or link to this item: https://tede.ufam.edu.br/handle/tede/7700
Tipo do documento: Tese
Título: A deep learning framework for BGP anomaly detection and classification
Autor: Fonseca, Paulo César da Rocha 
Primeiro orientador: Mota, Edjard Souza
Primeiro membro da banca: Feitosa, Eduardo Luzeiro
Segundo membro da banca: Carvalho, André Luiz da Costa
Terceiro membro da banca: Souza, Jose Neuman de
Quarto membro da banca: Cunha, Italo Fernando Scotá
Resumo: The Border Gateway Protocol (BGP) is the default Internet routing protocol that manages connectivity among Autonomous Systems (ASes). Although BGP disruptions are rare when they occur the consequences can be very damaging. Consequently, there has been a considerable effort aimed at understanding what is normal and abnormal BGP traffic and, in so doing, enable potentially disruptive anomalous traffic to be identified quickly. Even though there is an extensive research on anomaly detection, there are two major gaps in current literature: the scarcity of public datasets for all types of events and the lack of a BGP anomaly classification framework that differentiates anomaly classes. Since that there are no public datasets of labeled BGP anomalous events, each model was validated using different datasets, which had to be individually generated for each approach. The absence of common groundwork dataset increases the difficulty in comparing different approaches. The lack of a classification framework hinders the deployment of specific mitigation measures to each anomaly class in an automated fashion. In the current work, we address both problems: 1) We provide a BGP dataset generation tool and publicly available datasets for different anomaly classes. These datasets contain the most used features by previous research efforts and additional novel features; 2) We address the BGP anomaly classification problem by developing a framework that uses deep learning as the core engine of an anomaly detection and classification mechanism. We built a model that exploits different neural network architectures advantages. Both novel features and the BGP anomaly detector and classifier were evaluated and it was demonstrated that they can be used to react to anomalies in real-time and leverage the deployment of different mitigation and coordination strategies to different anomaly classes in an autonomous fashion.
Abstract: The Border Gateway Protocol (BGP) is the default Internet routing protocol that manages connectivity among Autonomous Systems (ASes). Although BGP disruptions are rare when they occur the consequences can be very damaging. Consequently, there has been a considerable effort aimed at understanding what is normal and abnormal BGP traffic and, in so doing, enable potentially disruptive anomalous traffic to be identified quickly. Even though there is an extensive research on anomaly detection, there are two major gaps in current literature: the scarcity of public datasets for all types of events and the lack of a BGP anomaly classification framework that differentiates anomaly classes. Since that there are no public datasets of labeled BGP anomalous events, each model was validated using different datasets, which had to be individually generated for each approach. The absence of common groundwork dataset increases the difficulty in comparing different approaches. The lack of a classification framework hinders the deployment of specific mitigation measures to each anomaly class in an automated fashion. In the current work, we address both problems: 1) We provide a BGP dataset generation tool and publicly available datasets for different anomaly classes. These datasets contain the most used features by previous research efforts and additional novel features; 2) We address the BGP anomaly classification problem by developing a framework that uses deep learning as the core engine of an anomaly detection and classification mechanism. We built a model that exploits different neural network architectures advantages. Both novel features and the BGP anomaly detector and classifier were evaluated and it was demonstrated that they can be used to react to anomalies in real-time and leverage the deployment of different mitigation and coordination strategies to different anomaly classes in an autonomous fashion.
Palavras-chave: Border Gateway Protocol
Machine Learning
Dataset generation
Autonomous Systems
Anomalias BGP
Área(s) do CNPq: CIÊNCIAS EXATAS E DA TERRA: CIÊNCIA DA COMPUTAÇÃO
???metadata.dc.subject.user???: Border Gateway Protocol
Anomaly detection
Machine Learning
Dataset generation
Detecção de anomalias
Idioma: eng
País: Brasil
Instituição: Universidade Federal do Amazonas
Sigla da instituição: UFAM
Departamento: Instituto de Computação
Programa: Programa de Pós-graduação em Informática
Citação: FONSECA, Paulo César da Rocha. A deep learning framework for BGP anomaly detection and classification. 2019. 117 f. Tese (Doutorado em Informática) - Universidade Federal do Amazonas, Manaus, 2019.
Tipo de acesso: Acesso Aberto
Endereço da licença: http://creativecommons.org/licenses/by/4.0/
URI: https://tede.ufam.edu.br/handle/tede/7700
Data de defesa: 18-Nov-2019
Appears in Collections:Doutorado em Informática

Files in This Item:
File Description SizeFormat 
Tese_PauloCésardaRocha_PPGI.pdfTese_PauloCésardaRocha_PPGI5 MBAdobe PDFThumbnail

Download/Open Preview


This item is licensed under a Creative Commons License Creative Commons