Country-wide Long-term Event Detection and Classification Mechanisms Using Spatiotemporal BGP Prefix Data

摘要

In a network of autonomous systems (ASes), prefix reachability can be affected by events such as link and node failures, router misconfiguration, route flaps and prefix hijack attacks. Furthermore, with the increase in global organizations deploying their data centres and content services in other countries that have good networking infrastructures, studying prefix reachability is of significance. Since detecting these events at the end user level is challenging, by monitoring the spatially distributed routing table features, such as AS path distributions and spatial prefix reachability distributions, the events can be detected at the control plane level. In this work, a measure and a method to detect long term events at a country level AS topology are proposed. To understand the occurrence of control plane level events, temporal pattern analysis over the distributed peer prefix announcements of a country-level AS topology was conducted. Five Asian countries are considered as a representative set to study the occurrence of events. To capture and measure the spatially occurring events in a single temporal pattern, we proposed a counting-based measure using prefixes announced by x % of n spatially distributed peers. Our method to detect events employs mean change point detection technique with normal and CUSUM test statistics over the proposed measure. Other statistical techniques such as regression estimation and K-means clustering are used in our method to quantify the impact and duration of long-term control plane events. The detected events are validated using average path pattern correlation and Fisher scores of different path length features. We also validated the events using the SEA-Me-We4 cable cut event manifestations. The comparison results with other event detection techniques demonstrate the efficacy of the mean change point technique with normal assumption used in our method.