Machine Learning for Detecting the WestRock Ransomware Attack Using BGP Routing Records
Zhida Li, Ana Laura Gonzalez Rios, Ljiljana Trajković
Abstract
Border Gateway Protocol (BGP) enables Internet data routing. Hence, its anomalies affect Internet connectivity and cause routing discon-nections, route flaps, and oscillations. Detection of anomalous BGP routing dynamics is a topic of great interest in cybersecurity. In this article, we survey machine learning algorithms for detecting BGP anomalies and intrusions. Gradient boosting decision tree and deep learning algorithms are evaluated by creating models using collected routing records during the WestRock ransomware event. BCPGuard, a BGP anomaly detection tool, has been developed to integrate various stages of the anomaly detection process.
Topics & Concepts
Border Gateway ProtocolComputer scienceDefault-free zoneRansomwareRouting protocolAnomaly detectionComputer networkThe InternetRouting (electronic design automation)Network mappingStatic routingDistributed computingArtificial intelligenceComputer securityMalwareWorld Wide WebNetwork Security and Intrusion DetectionAnomaly Detection Techniques and ApplicationsInternet Traffic Analysis and Secure E-voting