Telemetry-based stream-learning of BGP anomalies

Abstract

Recent technology evolution allows network equipments to continuously stream a wealth of "telemetry" information, which pertains to multiple protocols and layers of the stack, at a very fine spatial-grain and at high-frequency. Processing this deluge of telemetry data in real-time clearly ofers new opportunities for network control and troubleshooting, but also poses serious challenges. We tackle this challenge by applying streaming machine-learning techniques to the continuous flow of control and data-plane telemetry data, with the purpose of real-time detection of BGP anomalies. In particular, we implement an anomaly detection engine that leverages DenStream, an unsupervised clustering technique, and apply it to features collected from a large-scale testbed comprising tens of routers traversed by 1 Terabit/sec worth of real application traffic. In spirit with the recent trend toward reproducibility of research results, we make our code, datasets and demo available as open source to the scientiffic community.