Machine Learning for Detecting the WestRock Ransomware Attack Using BGP Routing Records

Abstract

Border Gateway Protocol (BGP) enables Internet data routing. Hence, its anomalies affect Internet connectivity and cause routing discon-nections, route flaps, and oscillations. Detection of anomalous BGP routing dynamics is a topic of great interest in cybersecurity. In this article, we survey machine learning algorithms for detecting BGP anomalies and intrusions. Gradient boosting decision tree and deep learning algorithms are evaluated by creating models using collected routing records during the WestRock ransomware event. BCPGuard, a BGP anomaly detection tool, has been developed to integrate various stages of the anomaly detection process.