BML: An Efficient and Versatile Tool for BGP Dataset Collection

Abstract

The Border Gateway Protocol (BGP) is in charge of the route exchange at the Internet scale. Anomalies in BGP's behaviour can have several causes (e.g. mis-configuration, outage and attacks) and despite being rare, their consequences can threaten the Internet stability and reliability. The study of such anomalies requires the extraction of specific features and internet topology from BGP data. The literature shows that adhoc procedures and tools have been developed to extract specific features to train machine learning models for anomaly detection. In this paper we propose BML, a BGP dataset generation tool that extracts the majority of known features in the literature, the internet topology and that allows the user to build specific features from BGP data. We illustrate the use of BML on a BGP anomaly by extracting 32 synthetic features and 14 BGP's graphs features which allow a comprehensive understanding of the Border Gateway Protocol.