Topology + Traffic: Real-Time BGP Anomaly Detection from RIPE RIS Raw Data

Machine learning approaches to BGP anomaly detection face a fundamental limitation in operational settings: models trained at one vantage point generalize poorly to another. This presentation reports on a doctoral research project, conducted entirely on RIPE RIS data, that quantifies this limitation and proposes a topology-aware approach to address it.

Three results are presented. First, a systematic benchmark of thirteen synthetic-traffic generators demonstrates that detection performance degrades substantially under cross-collector evaluation; notably, the generator with the highest same-collector fidelity exhibits the largest degradation, with 35–41% of anomalies going undetected. Second, augmenting UPDATE-stream statistics with AS-level topology derived from RIB snapshots restores robustness, and a density-based criterion determines the appropriate model class for each network. Third, the resulting detector is validated on two real-world events: it identified the April 2025 Iberian power outage within ten minutes of the onset of its BGP signal, at a 1.3% false-alarm rate, using a model trained five months earlier without retraining; and in a blind evaluation on AS766 (RedIRIS), network operators independently confirmed a detected 65-minute routing episode based on timestamps alone.