Principal component analysis of BGP update streams

Abstract

In this paper, we propose a novel methodology to identify border gateway protocol (BGP) updates associated with major events — affecting network reachability to multiple ASes — and separate them (statistically) from those attributable to minor events, which individually generate few updates, but collectively form the persistent background noise observed at BGP vantage points. Our methodology is based on principal component analysis, which enables us to transform and reduce the BGP updates into different AS clusters that are likely affected by distinct major events. We demonstrate the accuracy and effectiveness of our methodology through simulations and real BGP data.