BGP Anomaly Detection Using Association Rule Mining Algorithm

Abstract

An anomaly is the occurrence of an exception that affects network security. The requirement for abnormality detection in a network is Anomaly detection, which detects and removes anomalous flow from the network. The Border Gateway Protocol (BGP) is the most common external Gateway Protocol used to communicate with autonomous systems to share routing and reachability information. This protocol's abnormal behavior may be caused by a variety of factors, including inadequate provisioning, malicious attacks, traffic or equipment issues, and network operator mistakes. BGP was built on the assumption of trust, and as a result, it has been hacked numerous times over the years. Code Red I is one well-known assault that targets BGP networking and produce abnormalities in its operation. These attacks were utilized as the dataset for training the model using network traffic data. The goal of this study is to detect the events that triggered an anomaly in the BGP during a time, as well as to detect an anomaly from the BGP throughout that time interval using the training dataset model. We present real association rule mining for BGP anomaly detection in the Intrusion Detection System (IDS).