The Border Gateway Protocol (BGP) is the backbone of inter-domain routing on the internet, but its susceptibility to both benign and malicious anomalies creates substantial risks to both network reliability and security. In this study, we present a new approach for deep learning-based BGP anomaly detection utilizing duplicate announcements, which are known to be a symptom of routing disruptions. We developed our methodology based on public BGP data from RIPE and Route Views. We used the number of duplicate announcements as a baseline against which we checked for sporadic and time-based anomalies. Here, we propose a deep learning framework based on the Exponential Moving Average (EMA) model in combination with Autoencoder for anomaly identification. We also apply the Temporal-oriented Synthetic Minority Over-Sampling Technique (T-SMOTE) to overcome data imbalance. Comparative evaluations show that the Autoencoder model is significantly better than LSTM and that existing state-of-the-art methods have higher accuracy, precision, recall, and F1 scores. This study proposes a reliable, scalable, and rapid framework for real-time BGP adversary detection, which improves network security and resilience.

The Internet plays a vital role in the exchange of information in society. Maintaining the security and robustness of the Internet anomaly detection in Border Gateway Protocol (BGP) traffic is very important so that stable routing services can be ensured. The existing solutions are based on the classical machine learning (ML) models, which need to be advanced. In this study, a revolutionary technique that utilizes the Extreme Learning Machine (ELM) to enhance the detection of anomalies in the dynamic environment of the Border Gateway Protocol (BGP), particularly when faced with highly imbalanced class distributions, was used. The combination of imbalanced class distribution and BGP’s dynamic nature often leads to the suboptimal performance of classifiers. Our proposed solution aims to address this imbalance issue by dividing the dominant classes into multiple sub-classes. This division is achieved through optimal partitioning (OP), which involves segmenting the samples from the majority class into different segments to approximate the size of the minority class. As a result, diversified classes are created to train the ELM classifier. In order to assess the effectiveness of the proposed (OP-ELM) model, the RIPE and BCNET datasets were utilized. These trace files were processed using MATLAB to extract and organize the necessary features, thereby generating suitable datasets for analysis, which are referred to as Dataset-1 and Dataset-2. The experimental findings exhibit noteworthy improvements in performance when contrasted with prior methodologies, thereby highlighting the efficacy of our innovative approach in tackling the obstacles associated with anomaly detection in BGP networks.