# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 3 BGP Anomalies and Attacks  
In this section, we provide a comprehensive overview of BGP anomalies and attacks, categorized based on their intent and impact. This section also discusses advanced BGP attacks that often evade detection by targeting blind spots in public BGP collectors. The dis  
Figure 1: BGP-speaking router. cussion emphasizes the critical need for next-generation anomaly detection techniques capable of addressing these advanced threats by analyzing group-level AS interactions. BGP anomalies and attacks have been studied extensively in the literature [6; 10; 11]. The severity of BGP incidents can range from the relatively innocuous (e.g., route flapping) through to destructive (e.g., BGP 'hijacking', rerouting, and 'blackholing'), with both non-malicious or malicious intent [10; 11]. BGP events (both malicious and non-malicious) have affected major Internet entities including Akamai, Apple, Amazon, Facebook, Google, Mastercard, and Microsoft [6; 7; 8]. In 2023, the Australian telecommunications company Optus experienced a BGP-related incident that impacted critical and emergency services [26; 27; 28]. A taxonomy of BGP anomalies has been previously constructed into the categories of direct intended anomalies, direct unintended anomalies, indirect anomalies, and outages (or link failures) [11]. Within each category, the authors further sub-classified BGP anomalies. The direct intended anomaly category represents the range of BGP hijacks currently known about (e.g., same-prefix, sub-prefix, stealth, and advanced BGP attacks). A network operator misconfiguration incident is a typical example of a direct unintended anomaly. Indirect anomalies are those affecting elements of Internet operations such as web servers. Examples of indirect events include significant cyber attacks (e.g., Nimda, Code Red II, and Slammer worm attacks) that affect ASs with intensified BGP activity and ultimately overload the Internet. For example, on the day preceding the Slammer worm incident, the average BGP announcement was 47 updates per prefix compared to the 4500 updates per prefix seen during the attack [29; 30]. Outages are those stemming from natural disasters or energy system failures (e.g., Japanese Earthquake, Moscow Blackout). BGP attacks have resulted in large volumes of the global Internet traffic being rerouted through state-owned entities, where numerous methods of cyber surveillance and retrospective forensics can be utilized. Nation-state-level actors can also manipulate the routing system to impose censorship [7; 31]. This places at risk the many businesses, transactions, devices, and global matters of state present on this shared resource every day. There have been several BGP rerouting and interception attack incidents in recent years where nation-state-owned telcos have been observed to reroute traffic in events that impacted Akamai, Alfa-Bank, Amazon, Apple, EMF, Facebook, Fortis, Google, MasterCard, Microsoft, and Symantec, among others [6; 31; 32; 33]. The nature and detectability of BGP attacks vary considerably [6; 34]. While some are stealthy, evading detection with subtle manipulations, others are more conspicuous, creating significant 'noise' in network activity (see Figure 2). These 'noisy' attacks often involve dramatic spikes in routing announcements or unusual patterns in AS path changes, making them more detectable but no less disruptive. Such attacks, due to their visible impact on routing data and network traffic flows, are particularly illustrative of the protocol's vulnerabilities. Figure 2: Noisy BGP hijack. This section outlines the multifaceted nature of BGP attacks, categorizing them based on their objectives, techniques, tactics, and impacts, as outlined in the existing literature [6]. The discussion begins with data falsification-based attacks, where malicious entities manipulate or forge routing information, including the nuances of prefix and subprefix hijacking and AS path manipulation. These attacks disrupt data flows and compromise the integrity of data transmission [6; 35].