Route Flap Research Articles

Machine Learning for Detecting the WestRock Ransomware Attack Using BGP Routing Records

Border Gateway Protocol (BGP) enables Internet data routing. Hence, its anomalies affect Internet connectivity and cause routing discon-nections, route flaps, and oscillations. Detection of anomalous BGP routing dynamics is a topic of great interest in cybersecurity. In this article, we survey machine learning algorithms for detecting BGP anomalies and intrusions. Gradient boosting decision tree and deep learning algorithms are evaluated by creating models using collected routing records during the WestRock ransomware event. BCPGuard, a BGP anomaly detection tool, has been developed to integrate various stages of the anomaly detection process.

Dynamic traffic classification algorithm and simulation of energy Internet of things based on machine learning

With the rapid development of information technology, a large amount of traffic generated by various Internet applications occupies a large amount of network resources. It poses a huge challenge to service quality and has a negative impact on Internet security. In order to utilize network resources effectively and provide effective management and control measures for network administrators, network traffic classification technologies is a hot topic for scientists to identify application layer protocols. Today, there are more and more applications based on TCP/IP. With the emergence of various anti-surveillance applications, traditional port and application-based identification methods are difficult to meet current or future traffic identification requirements. It has become a very challenging problem to require more efficient, accurate, intelligent and real-time Internet traffic identification. The Internet of Things is a new network concept proposed by people who based on Internet prototypes. It enables the end user of the system can carry out communication and exchange of information and data between any project. In recent years, with the continuous advancement of Internet of Things technology, the coverage of the Internet of Things has become very wide, and the number of different types of networks that make up the Internet of Things is also increasing. This paper aims to find the dynamic network traffic classification problem of hybrid fixed in dynamic network and dynamic network in mobile network, and gives a reasonable mapping scheme. The dynamics of network traffic for Internet of Things are reflected fully and will not cause route flapping. The simulation results show that the decision tree classification algorithm in machine learning has higher efficiency, and improves the utilization of network resources.

CRO-SS: A Route Oscillation Suppression Scheme for IP-Based Satellite Network

With the increasing demand for Internet access in rural, remote, and other areas, using the IP-based satellite network has become a trend to provide global Internet services. An important aspect of building this network is to achieve efficient routing. However, when we conducted a systematic analysis of the routing efficiency of such a network, we found a severe route oscillation problem in the cross region of satellite orbits. This problem occurs every 67.4 seconds and causes 8.3% ~ 24.1% of end-to-end paths in the entire network to flap, thus seriously damaging the routing efficiency and network performance. We term this the cross route oscillation (CRO) problem and found that it is primarily caused by the conflict between the path length and path lifetime. Subsequently, we propose the cross route oscillation suppression scheme (CRO-SS) to suppress CRO by decoupling that conflict. The extensive experiments using real-world data indicate that CRO-SS can significantly improve routing stability and network performance. The occurrence frequency of route flapping, the total number of changed paths, and the total number of affected satellite nodes over a system period are approximately 24.7%, 58.5%, and 63.1%, respectively. Meanwhile, the throughput is increased by 20% and the packet loss rate is decreased by 72.4% ~ 97.8%.

Node stability-based routing in Wireless Mesh Networks

Network stability is a key performance metric in supporting real time communication over wireless networks. Because of high bandwidth demand and dynamic traffic variation, several paths in Wireless Mesh Networks (WMNs) are expected to be unstable. High levels of network instability can lead to interferences, packet losses and high delays.In this paper, we address the stability problem of WMNs. Instability in these networks is caused mainly by link quality fluctuations and frequent route flapping. First, we present the key factors that may cause network instability. Then, we propose a new technique, called Node Stability-based Routing (NSR), using the entropy function to define a node stability and a probability function to select an appropriate gateway. Simulation results show that NSR can significantly improve the overall network performance compared to techniques using interference and channel switching (MIC), Expected Transmission count (ETX) or load at gateways as a routing metric, Reinforcement learning-based best path to best gateway (RLBDR), and nearest gateway (i.e., shortest path to gateway).

Characterizing Inter-Domain Rerouting by Betweenness Centrality after Disruptive Events

Rerouting is not uncommon in nowadays Internet because it can be triggered by many root causes, such as network faults, routing attacks, etc. However, few methods effectively characterize rerouting in the whole Internet. In this paper, inspired by a well known network science metric - betweenness centrality, we propose a new approach to characterize inter-domain reroutings. By defining and analysing the variation of AS betweenness centrality for neighbouring-destination routes and global routes separately, our method empowers users to identify the temporal, topological, and relational characteristics of route changes. We apply our method to investigate the Internet's reactions to four different disruptive events, including Japan earthquake in March 2011, SEA-ME-WE 4 cable fault in April 2010, routing attack on YouTube in February 2008, and AS4761 hijacking event in January 2011. This examination reveals many new insights. For example, the route flapping and the congestion caused by the side-effect of rerouting after cable faults significantly degraded path quality. Moreover, direct providers of attackers and victims are the most critical positions for amplifying impact of prefix hijacking attacks. Such results shed light on how to implement effective reactions to network faults and how to deploy efficient defense mechanisms against routing attacks.

Scaling Inter-domain Routing System via Path Exploration Aggregation

One of the most important scalability issues facing the current Internet is the rapidly increasing rate of BGP updates (BGP churn), to which route flap and path exploration are the two major contributors. Current countermeasures would either cause severe reachability loss or delay BGP convergence, and are becoming less attractive for the rising concern about routing convergence as the prevalence of Internet-based real time applications. Based on the observation that highly active prefixes usually repeatedly explore very few as-paths during path exploration, we propose a router-level mechanism, Path Exploration Aggregation (PEA), to scale BGP without either causing prefix unreachable or slowing routing convergence. PEA performs aggregation on the transient paths explored by a highly active prefix, and propagates the aggregated path instead to reduce the updates caused by as-path changes. Moreover, in order to avoid the use of unstable routes, PEA purposely prolongs the aggregated path via as-path prepending to make it less preferred in the perspective of downstream routers. With the BGP traces obtained from RouteViews and RIPE-RIS projects, PEA can reduce BGP updates by up to 63.1%, shorten path exploration duration by up to 53.3%, and accelerate the convergence 7.39 seconds on average per routing event.

A Technique for Reducing BGP Update Announcements through Path Exploration Damping

This paper defines and evaluates Path Exploration Damping (PED) - a router-level mechanism for reducing the volume of propagation of likely transient update messages within a BGP network and decreasing average time to restore reachability compared to current BGP Update damping practices. PED selectively delays and suppresses the propagation of BGP updates that either lengthen an existing AS Path or vary an existing AS Path without shortening its length. We show how PED impacts on convergence time compared to currently deployed mechanisms like Route Flap Damping (RFD), Minimum Route Advertisement Interval (MRAI) and Withdrawal Rate Limiting (WRATE). We replay Internet BGP update traffic captured at two Autonomous Systems to observe that a PED-enabled BGP speaker can reduce the total number of BGP announcements by up to 32% and reduce Path Exploration by 77% compared to conventional use of MRAI. We also describe how PED can be incrementally deployed in the Internet, as it interacts well with prevailing MRAI deployment, and enables restoration of reachability more quickly than MRAI.

Root cause notification RFD algorithm with path exploration detection

Route Flap Damping(RFD) was a mechanism that played as a key contributor for Internet routing stability.In this paper,Root Cause Notification(RCN) route flap damping algorithm produced a lot of updates because invalid path exploration were noted,so a root cause notification RFD algorithm with path exploration detection using the RCN table and the characteristics of routes generated in path exploration was proposed.The algorithm can distinguish route flap and path exploration correctly and damp the invalid routes.The simulation results indicate that the algorithm can reduce the number of updates significantly and improve performance of the RFD.

Time Window Mechanism to Improve BGP Routing Convergence

PDF HTML阅读 XML下载 导出引用 引用提醒 改善BGP路由收敛的时间窗口机制 DOI: 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: Supported by the National Natural Science Foundation of China under Grant No.60473082 (国家自然科学基金); the National Basic Research Program of China under Grant No.2003CB314801 (国家重点基础研究发展计划(973)) Time Window Mechanism to Improve BGP Routing Convergence Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:提出了一种时间窗口机制,能够基于路由抖动抑制中路由惩罚值的变化改善BGP(border gateway protocol)路由收敛.这种新机制把来自不同邻居的路由变化情况结合起来,利用BGP路由传播过程形成的路由相关性判断路由在网络中的稳定情况.时间窗口机制使BGP路由器能够更早地发现不稳定路由,优先将稳定路由选择为最优路由,终止路径搜索过程.模拟实验的结果表明,通过选择适当的参数,时间窗口机制能够大大缩短BGP路由收敛延时,减小收敛过程中的通信开销.而且,这种方法不需要在BGP的路由消息中增加额外的信息,因此容易在实际网络中逐步部署. Abstract:In this paper, a time window mechanism based on the penalty value of route flap damping is designed to improve routing convergence. This mechanism judges the route stability in the network from BGP (border gateway protocol) routes correlation by observing multiple routes received from different peers jointly. Then BGP speaker can find instable routes earlier and makes stable routes get the chance to be selected earlier in route selection, thus curtail path exploration. Simulation results prove that with proper parameters this method can reduce convergence delay and communication overhead obviously. Furthermore, without addition information in BGP Update message, time window mechanism is a practical method to be deployed in the Internet. 参考文献 相似文献 引证文献

A TLP approach for BGP based on local speculation

With the explosive growth of Internet, the low efficiency of BGP has seriously influenced its usability. In this work, a TLP (thread level parallelism) approach with local speculation is proposed to improve the BGP performance. The thread partition is locally performed on each separated sub-module at route processing, and the speculation strategy is implemented to guarantee the memory consistency and sequential commit. Experiments on Intel Quad-core server show that this approach reaches an average speedup of 1.46 under single peer, multi-peers and route flapping. It is also shown that the packet throughput can be improved greatly under multiple sessions by taking advantage of TLP.

Comparison of two routing metrics in OLSR on a grid based mesh network

Predicting the performance of ad hoc networking protocols for mesh networks has typically been performed by making use of software based simulation tools. Experimental study and validation of such predictions is a vital to obtaining more realistic results, but may not be possible under the constrained environment of network simulators. This paper presents an experimental comparison of OLSR using the standard hysteresis routing metric and the ETX metric in a 7 by 7 grid of closely spaced Wi-Fi nodes to obtain more realistic results. The wireless grid is first modelled to extract its ability to emulate a real world multi-hop ad hoc network. This is followed by a detailed analysis of OLSR in terms of hop count, routing traffic overhead, throughput, delay, packet loss and route flapping in the wireless grid using the hysteresis and ETX routing metric. It was discovered that the ETX metric which has been extensively used in mesh networks around the world is fundamentally flawed when estimating optimal routes in real mesh networks and that the less sophisticated hysteresis metric shows better performance in large dense mesh networks.

Damping BGP route flaps

BGP route flap damping (RFD) was anecdotally considered to be a key contributor to the stability of the global Internet inter-domain routing system. However, it was recently shown that RFD can incorrectly suppress for substantially long periods of time relatively stable routes, i.e., routes that only fail occasionally. This phenomenon can be attributed to the complex interaction between BGP path exploration and how the RFD algorithm identifies route flaps. In this paper we identify a distinct characteristic of BGP path exploration following a single network event such as a link or router failure. Based on this characteristic, we distinguish BGP route updates during BGP path exploration from route flaps and propose a novel BGP route flap damping algorithm, RFD+. RFD+ has a number of attractive properties in improving Internet routing stability. In particular, it can correctly suppress persistent route flaps without affecting routes that only fail occasionally. In addition to presenting the new algorithm and analyzing its properties, we also perform simulation studies to illustrate the performance of the algorithm.

Modified flap damping mechanism to improve inter-domain routing convergence

Inter-domain routing stability and convergence delay have a significant effect on QoS in the Internet. To enhance the stability and reduce the convergence time of the Internet, RFD was introduced to limit route oscillations from spreading throughout the network. However, recent research has shown that RFD may damp relatively stable routes due to its reaction to path exploration and the interaction between RFD reuse timers. In this paper, a variation of RFD is proposed that addresses the negative side effects of RFD with respect to route convergence and stability. Route flapping is confined by neighboring nodes, and invalid routes generated by path exploration are reduced by an RFD-like mechanism. Simulation results indicate that the modified flap damping mechanism limits persistent flapping routes while allowing relatively stable routes to converge more quickly.

Study of BGP Peering Session Attacks and Their Impacts on Routing Performance

We present a detailed study of the potential impact of border gateway protocol peering session attacks and the resulting exploitation of route flap damping (RFD) that cause network-wide routing disruptions. We consider canonical grid as well as down-sampled realistic autonomous system (AS) topologies and address the impact of various typical service provider routing policies. Our modeling focuses on three dimensions of routing performance sensitivity: 1) protocol aware attacks (e.g., tuned to RFD); 2) route selection policy; and 3) attack-region topology. Analytical results provide insights into the nature of the problem and potential impact of the attacks. Detailed packet-level simulation results complement the analytical models and provide many additional insights into specific protocol interactions and timing issues. Finally, we quantify the potential effect of the BGP graceful restart mechanism as a partial mitigation of the BGP vulnerability to peering session attacks.

Avoiding instability during graceful shutdown of multiple OSPF routers

Many recent router architectures decouple the routing engine from the forwarding engine, allowing packet forwarding to continue even when the routing process is not active. This opens up the possibility of using the forwarding capability of a router even when its routing process is brought down for software upgrade or maintenance, thus avoiding the route flaps that normally occur when the routing process goes down. Unfortunately, current routing protocols, such as BGP, OSPF and IS-IS do not support such operation. In an earlier paper, we described an enhancement to OSPF, called the IBB (I'll Be Back) capability, that enables a router to continue forwarding packets while its routing process is inactive. When the OSPF process in an IBB-capable router is inactive, it cannot adapt its forwarding table to reflect changes in network topology. This can lead to routing loops and/or black holes. In this paper, we focus on the loop problem and provide a detailed analysis of how and when loops are formed and propose solutions to prevent them. We develop two necessary conditions for the formation of routing loops in the general case when multiple routers are inactive. These conditions can easily be checked by the neighbors of the inactive routers. Simulations on several network topologies showed that checking the two conditions together signaled a loop in most cases only when a loop actually existed

A Synchronization Framework and Critical Algorithm Maintaining Single Image of IP Forwarding Tables Among Cluster Router’s Nodes

With the rapid development of Internet, traditional centralized routers can not meet the requirements of next generation Internet on reliability, performance scalability and service scalability. Cluster routers will be the most important components of future Internet. It is very important for cluster routers to maintain the same forwarding table images among cluster router nodes. Different synchronization mechanisms have variant performance to control plane and packet forwarding plane. After the analysis of two typical synchronization mechanisms, this paper proposes an asymmetrical forwarding table synchronization framework— AREF (asymmetrical routes electing framework) synchronization framework. It fits the requirements of massively parallel cluster routers architecture perfectly. Continuous route flapping of the backbone network burdens the synchronization mechanisms of cluster routers. AREF synchronization algorithm is proposed to decrease the synchronization costs of AREF synchronization framework during route flapping. It uses route cache to predict a new best route when the original best route is deleted, and reduces the synchronization cost of AREF synchronization framework greatly. AREF synchronization framework and algorithm requires diverse abilities for different routing node types and can be used in heterogeneous cluster router widely.

High-performance IP forwarding with efficient routing-table update

There has been an extensive study in constructing the routing tables during the past few years. Although the existing works have certain advantages, those approaches either use complicated data structures which result in large storage requirement and high complexity for updating/building the forwarding table or they are not scalable to fit in Internet protocol version 6 (IPv6). In this work, we propose a fast forwarding-table construction algorithm. With the modified multiway search tree, we can further reduce the depth of the tree and eliminate the storage for pointers. It leads to reduce the FT size and shorten the routing-table lookup time. While considering the route flaps, the forwarding performance will degrade by only 3.1% with 4000 BGP updates per 30 s in the worst case. Moreover, it is simple enough to fulfill the need of the fast packet forwarding. An extension approach to solve the IPv6 routing lookup is also presented for the future deployment.

Route flap damping exacerbates internet routing convergence

Route flap damping is considered to be a widely deployed mechanism in core routers that limits the widespread propagation of unstable BGP routing information. Originally designed to suppress route changes caused by link flaps, flap damping attempts to distinguish persistently unstable routes from routes that occasionally fail. It is considered to be a major contributor to the stability of the Internet routing system.We show in this paper that, surprisingly, route flap damping can significantly exacerbate the convergence times of relatively stable routes. For example, a route to a prefix that is withdrawn exactly once and re-announced can be suppressed for up to an hour (using the current RIPE recommended damping parameters). We show that such abnormal behavior fundamentally arises from the interaction of flap damping with BGP path exploration during route withdrawal. We study this interaction using a simple analytical model and understand the impact of various BGP parameters on its occurrence using simulations. Finally, we outline a preliminary proposal to modify route flap damping scheme that removes the undesired interaction in all the topologies we studied. .

Stability issues in OSPF routing

We study the stability of the OSPF protocol under steady state and perturbed conditions. We look at three indicators of stability, namely, (a) network convergence times, (b) routing load on processors, and (c) the number of route flaps. We study these statistics under three different scenarios: (a) on networks that deploy OSPF with TE extensions, (b) on networks that use subsecond HELLO timers, and (c) on networks that use alternative strategies for refreshing link-state information. Our results are based on a very detailed simulation of a real ISP network with 292 nodes and 765 links.

Routing stability in congested networks

Loss of the routing protocol messages due to network congestion can cause peering session failures in routers, leading to route flaps and routing instabilities. We study the effects of traffic overload on routing protocols by quantifying the stability and robustness properties of two common Internet routing protocols, OSPF and BGP, when the routing control traffic is not isolated from data traffic. We develop analytical models to quantify the effect of congestion on the robustness of OSPF and BGP as a function of the traffic overload factor, queueing delays, and packet sizes. We perform extensive measurements in an experimental network of routers to validate the analytical results. Subsequently we use the analytical framework to investigate the effect of factors that are difficult to incorporate into an experimental setup, such as a wide range of link propagation delays and packet dropping policies. Our results show that increased queueing and propagation delays adversely affect BGP's resilience to congestion, in spite of its use of a reliable transport protocol. Our findings demonstrate the importance of selective treatment of routing protocol messages from other traffic, by using scheduling and utilizing buffer management policies in the routers, to achieve stable and robust network operation.