Asymmetric feature selection for BGP abnormal events detection

Abstract

Border Gateway Protocol (BGP), which is the defacto standard inter-domain routing protocol in the Internet today, has severe problems, such as worm viruses, denial of service (DoS) attacks, etc. To ensure the stability and security of the inter-domain routing system in the autonomy system, it is critical to accurately and quickly detect abnormal BGP events. In this paper, a novel feature selection algorithm based on the asymmetric entropy named FSAMI is proposed to evaluate the characteristics of describing the BGP abnormal events, which is independent on the machine learning methods. Meanwhile the under-sampling, neural network (NN) and feature selection are introduced to predict BGP abnormal activities to treat the imbalance problem. Numerical experimental results on RIPE archive data set show that the FSAMI method improves the g-means values of abnormal events detection and helps to improve the prediction ability. © 2009 Springer.