# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 1 Introduction  
The Internet has been described as a complex, dynamic, massively distributed, scaled, and internetworked system whose designers could not have foreseen its evolution into one of humankind's most profound creations [1, 2, 3]. Internet traffic is exchanged via connections using an inter-domain protocol [4]. The critical, and insecure, inter-domain protocol that binds the Internet is known as the Border Gateway Protocol (BGP); it connects more than 80,000 Autonomous System (AS) networks (henceforth referred to as ASs) by routing traffic between them. The number of ASs used may be larger when taking into account private and reserved ASs. Internetwork protocol security was not the primary focus for the designers of the Internet, although network protocol innovation is inextricably linked to the history of the Internet. For example, the Transmission Control Protocol and Internet Protocol (TCP/IP), which remains central to networking today and was developed from the work at the Defense Advanced Research Projects Agency (DARPA) [5]. Both malicious and non-malicious BGP incidents have affected major Internet entities including Akamai, Amazon, Apple, Facebook, Google, Mastercard, and Microsoft [6, 7, 8]. BGP anomalies can range in impact from the comparatively harmless example of route flapping through to destructive route leaks and hijacks [6, 9, 10]. BGP incidents are categorized as being either direct (intentional or unintentional), indirect, or outages [11]. BGP hijacking and route leaking incidents are well-established examples of direct incidents (e.g., the Telekom Malaysia incident). Whereas indirect events include cyber incidents that disrupt critical Internet operations and indirectly impact the BGP (e.g., Internet worms such as Wannacrypt). Outages are those stemming from natural disasters and/or energy system failures (e.g., the Moscow Blackout incident). Despite the correlation of multivariate data from ASs, current BGP anomaly detection techniques are limited, and analysis is largely drawn from single monitoring points. Yet, the Internet is a complex phenomenon with many monitoring points and interactions, while the BGP itself is a nonlinear dynamical system that requires high-dimensional anomaly detection [12]. At best, most techniques seek to infer dynamics and information from single observables. Notwithstanding previously successful analyses of multivariate data and many features [11; 12; 13; 14], such techniques are limited with respect to more advanced attacks. For example, an advanced BGP attack has been designed to avoid public collector infrastructure and target routing monitor blind spots to exploit single-observable approaches [8; 15]. Extant techniques provide insufficient detection visibility, and advanced BGP detection techniques require capability at the multi-AS internetworked group level. This requires the adequate modeling of BGP speakers to investigate how groups of ASs are similar and differ from one another in terms of their interactions, as well as the dynamics of large groups of ASs. Many techniques have been used to analyze BGP traffic from a single AS, or from single monitoring points, and inferences made from collectors; however, we model the BGP as a multidimensional, multi-observable system for the purposes of identifying candidate techniques that can capture and quantify the dynamics of multiple groups of distributed ASs for multi-viewpoint (MVP) anomaly detection. The ability to capture the group-level information and dynamics of ASs is key. This includes investigating our ability to detect BGP anomalies using multiple monitoring and vantage points and the effectiveness of using multiple peers in BGP collectors through identifying how the peers within collectors interact with each other, the group dynamics at play, and how peers in collectors may differ. In other words, the ability to capture, quantify, and use group-level AS information for group-level AS anomaly detection.