Unveiling the potential of graph neural networks for BGP anomaly detection

The Border Gateway Protocol (BGP) is central to the global connectivity of the Internet, enabling fast and efficient dissemination of routing information. Hence, detecting any anomaly concerning BGP announcements is of critical importance to ensure the continuous operation of Internet services. Typically, BGP anomaly detection algorithms have relied on features of the BGP messages, such as the average length of the AS_PATH attribute, the volume of messages, or the type of message (announcement or withdrawal). Even though these algorithms provide good performance, they do not take into account the BGP topology, that is, the graph of ASes created by the BGP announcements. In this paper we investigate if such topology can be useful to predict BGP anomalies. We leverage Graph Neural Networks (GNN), a subset of the Neural Network (NN) family that is designed to process graph-structured data. We propose a GNN model to detect BGP anomalies and study its generalization capability. We compare its performance with two baseline models: a Support Vector Machine (SVM) and a Multilayer Perceptron (MLP), two Machine Learning (ML) techniques used in state-of-the-art solutions. Our GNN model achieves an accuracy of 79.6% using a weakly supervised dataset of 300 anomalies and is able to outperform the two baseline models.