Patent Document ID: 10148690
Application ID: 14977261
Patent Flag: 1

Claim One:
1. A method, comprising: receiving, by a data collection module, routing data associated with a Border Gateway Protocol (BGP) event from at least one BGP router that is associated with at least one upstream autonomous system (AS), wherein the routing data includes: a number of times that the at least one upstream AS has been observed announcing new Internet Protocol (IP) prefixes for less than ten days, and a duration of time that the at least one upstream AS has announced new IP prefixes; processing, by a data processor, the routing data to generate a list of features associated with an origin, a prefix, or upstream equipment, wherein the list of features includes a ratio between the number of days that the at least one upstream AS has been observed announcing new IP prefixes for less than ten days and the duration of time that the at least one upstream AS has announced new IP prefixes; receiving, from a database, a set of historically confirmed BGP hijack data; generating a hijack detection model by employing a positive unlabeled learning (PU learning) algorithm using (i) the routing data, (ii) the list of features, including the ratio between the number of days that the at least one upstream AS has been observed announcing new IP prefixes for less than ten days and the duration of time that the at least one upstream AS has announced new IP prefixes, and (iii) the set of historically confirmed BGP hijack data, wherein generating the hijack detection model does not consider historically confirmed benign BGP data; classifying the BGP event as a malicious event or a benign event using the hijack detection model; determining, in response to a malicious event, a block of IP addresses associated with the malicious event; accessing a routing table to identify at least one corrupted path associated with the malicious event; generating a corrected path using the routing table; and updating the routing table with the corrected path.