{"id":"https://openalex.org/W4414079681","doi":"https://doi.org/10.1109/tifs.2025.3607239","title":"<i>GraphBGP</i>: BGP Anomaly Detection Based on Dynamic Graph Learning","display_name":"<i>GraphBGP</i>: BGP Anomaly Detection Based on Dynamic Graph Learning","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414079681","doi":"https://doi.org/10.1109/tifs.2025.3607239"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3607239","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3607239","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5057343303","display_name":"Zheng Wu","orcid":"https://orcid.org/0000-0002-7919-5490"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zheng Wu","raw_affiliation_strings":["College of Computer, Nanjing University of Posts and Telecommunications (NJUPT), Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-7919-5490","affiliations":[{"raw_affiliation_string":"College of Computer, Nanjing University of Posts and Telecommunications (NJUPT), Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008766343","display_name":"Yanbiao Li","orcid":"https://orcid.org/0000-0001-7408-2203"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210108629","display_name":"Computer Network Information Center","ror":"https://ror.org/01s0wyf50","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210108629"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanbiao Li","raw_affiliation_strings":["Computer Network Information Center, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-7408-2203","affiliations":[{"raw_affiliation_string":"Computer Network Information Center, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210108629","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100327844","display_name":"Xin Wang","orcid":"https://orcid.org/0000-0001-8639-3818"},"institutions":[{"id":"https://openalex.org/I59553526","display_name":"Stony Brook University","ror":"https://ror.org/05qghxh33","country_code":"US","type":"education","lineage":["https://openalex.org/I59553526"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xin Wang","raw_affiliation_strings":["Department of Electrical and Computer Engineering, Stony Brook University, Stony Brook, NY, USA"],"raw_orcid":"https://orcid.org/0000-0001-8639-3818","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, Stony Brook University, Stony Brook, NY, USA","institution_ids":["https://openalex.org/I59553526"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024464918","display_name":"Zulong Diao","orcid":"https://orcid.org/0000-0001-6581-7511"},"institutions":[{"id":"https://openalex.org/I121296143","display_name":"Hunan University of Science and Technology","ror":"https://ror.org/02m9vrb24","country_code":"CN","type":"education","lineage":["https://openalex.org/I121296143"]},{"id":"https://openalex.org/I24407930","display_name":"Hunan University of Science and Engineering","ror":"https://ror.org/04ymz0q33","country_code":"CN","type":"education","lineage":["https://openalex.org/I24407930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zulong Diao","raw_affiliation_strings":["School of Computer Science and Engineering, Hunan University of Science and Technology, Xiangtan, China","School of Computer Science and Engineering, Hunan University of Science and Technology, china"],"raw_orcid":"https://orcid.org/0000-0001-6581-7511","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, Hunan University of Science and Technology, Xiangtan, China","institution_ids":["https://openalex.org/I121296143"]},{"raw_affiliation_string":"School of Computer Science and Engineering, Hunan University of Science and Technology, china","institution_ids":["https://openalex.org/I121296143","https://openalex.org/I24407930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039941317","display_name":"Weibei Fan","orcid":"https://orcid.org/0000-0003-1255-5815"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weibei Fan","raw_affiliation_strings":["College of Computer, Nanjing University of Posts and Telecommunications (NJUPT), Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-1255-5815","affiliations":[{"raw_affiliation_string":"College of Computer, Nanjing University of Posts and Telecommunications (NJUPT), Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100602821","display_name":"Fu Xiao","orcid":"https://orcid.org/0000-0003-1815-2793"},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fu Xiao","raw_affiliation_strings":["College of Computer, Nanjing University of Posts and Telecommunications (NJUPT), Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-1815-2793","affiliations":[{"raw_affiliation_string":"College of Computer, Nanjing University of Posts and Telecommunications (NJUPT), Nanjing, China","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5030689390","display_name":"Gaogang Xie","orcid":"https://orcid.org/0000-0003-4964-1135"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210108629","display_name":"Computer Network Information Center","ror":"https://ror.org/01s0wyf50","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210108629"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gaogang Xie","raw_affiliation_strings":["Computer Network Information Center, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-4964-1135","affiliations":[{"raw_affiliation_string":"Computer Network Information Center, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210108629","https://openalex.org/I19820366"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.11144504,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"20","issue":null,"first_page":"9864","last_page":"9877"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9972000122070312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.9768999814987183,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9674999713897705,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7853000164031982},{"id":"https://openalex.org/keywords/border-gateway-protocol","display_name":"Border Gateway Protocol","score":0.7694000005722046},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.5375000238418579},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5041000247001648},{"id":"https://openalex.org/keywords/default-free-zone","display_name":"Default-free zone","score":0.42890000343322754},{"id":"https://openalex.org/keywords/network-mapping","display_name":"Network mapping","score":0.41100001335144043},{"id":"https://openalex.org/keywords/routing","display_name":"Routing (electronic design automation)","score":0.4043000042438507},{"id":"https://openalex.org/keywords/reachability","display_name":"Reachability","score":0.37279999256134033},{"id":"https://openalex.org/keywords/tracing","display_name":"Tracing","score":0.3546999990940094}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8756999969482422},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7853000164031982},{"id":"https://openalex.org/C178086212","wikidata":"https://www.wikidata.org/wiki/Q11155","display_name":"Border Gateway Protocol","level":5,"score":0.7694000005722046},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.5375000238418579},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5041000247001648},{"id":"https://openalex.org/C101396714","wikidata":"https://www.wikidata.org/wiki/Q3021187","display_name":"Default-free zone","level":5,"score":0.42890000343322754},{"id":"https://openalex.org/C133474645","wikidata":"https://www.wikidata.org/wiki/Q17104660","display_name":"Network mapping","level":3,"score":0.41100001335144043},{"id":"https://openalex.org/C74172769","wikidata":"https://www.wikidata.org/wiki/Q1446839","display_name":"Routing (electronic design automation)","level":2,"score":0.4043000042438507},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3930000066757202},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3880999982357025},{"id":"https://openalex.org/C136643341","wikidata":"https://www.wikidata.org/wiki/Q1361526","display_name":"Reachability","level":2,"score":0.37279999256134033},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.3546999990940094},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.3490000069141388},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3395000100135803},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.33149999380111694},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.3181999921798706},{"id":"https://openalex.org/C9628104","wikidata":"https://www.wikidata.org/wiki/Q788009","display_name":"Autonomous system (mathematics)","level":2,"score":0.31439998745918274},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.2957000136375427},{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.28299999237060547},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2703999876976013},{"id":"https://openalex.org/C13540734","wikidata":"https://www.wikidata.org/wiki/Q5318996","display_name":"Dynamic network analysis","level":2,"score":0.26969999074935913},{"id":"https://openalex.org/C187713609","wikidata":"https://www.wikidata.org/wiki/Q2465461","display_name":"Default gateway","level":2,"score":0.2671999931335449},{"id":"https://openalex.org/C2778456923","wikidata":"https://www.wikidata.org/wiki/Q5337692","display_name":"Edge computing","level":3,"score":0.26170000433921814},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.25929999351501465},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.25040000677108765}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3607239","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3607239","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1872422098","display_name":null,"funder_award_id":"62372248","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4755501051","display_name":null,"funder_award_id":"62402234","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G478566191","display_name":null,"funder_award_id":"62102196","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":29,"referenced_works":["https://openalex.org/W2051381393","https://openalex.org/W2083686783","https://openalex.org/W2103117727","https://openalex.org/W2344605718","https://openalex.org/W2461239771","https://openalex.org/W2542543501","https://openalex.org/W2567172578","https://openalex.org/W2797475117","https://openalex.org/W2811460725","https://openalex.org/W2895447227","https://openalex.org/W2964146404","https://openalex.org/W2970669891","https://openalex.org/W2980910426","https://openalex.org/W3094353319","https://openalex.org/W3108674801","https://openalex.org/W3181717043","https://openalex.org/W3191802839","https://openalex.org/W3197636736","https://openalex.org/W3206604724","https://openalex.org/W3208400243","https://openalex.org/W4212974917","https://openalex.org/W4226393944","https://openalex.org/W4239094729","https://openalex.org/W4244336785","https://openalex.org/W4283213705","https://openalex.org/W4283701207","https://openalex.org/W4307020396","https://openalex.org/W4308642419","https://openalex.org/W4394615905"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"Detecting":[0],"anomalous":[1],"BGP":[2,36,63,93,114,173],"(Border":[3],"Gateway":[4],"Protocol)":[5],"messages":[6],"is":[7],"critical":[8],"for":[9],"securing":[10],"inter-domain":[11],"routing":[12,23,94],"systems":[13],"over":[14],"autonomous":[15],"system":[16],"(AS)-level":[17],"networks.":[18],"The":[19],"dynamic":[20],"nature":[21,91],"of":[22,27,92,191],"policies,":[24],"massive":[25],"scale":[26],"global":[28,32],"routes,":[29],"and":[30,77,79,108,132,145,152],"incomplete":[31],"topology":[33],"visibility":[34],"make":[35],"anomalies":[37],"exceptionally":[38],"challenging":[39],"to":[40,45,87,116],"identify\u2014let":[41],"alone":[42],"trace":[43],"back":[44],"malicious":[46,82,182],"or":[47,83,183],"misconfigured":[48,84,184],"ASes.":[49,85],"To":[50],"effectively":[51],"overcome":[52],"these":[53],"barriers,":[54],"this":[55,118,122],"paper":[56],"proposes":[57],"<italic":[58,96,126,157,177],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[59,97,127,158,178],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">GraphBGP</i>,":[60],"a":[61,187],"novel":[62],"anomaly":[64,75,143,162,195],"detection":[65,76,131,163],"method":[66],"that":[67,104,156],"dynamically":[68,105],"constructs":[69,99],"real-time":[70],"AS-level":[71,102],"topologies,":[72],"achieves":[73,160],"precise":[74,142],"classification,":[78],"accurately":[80],"traces":[81,181],"Specifically,":[86],"address":[88],"the":[89],"evolving":[90],"status,":[95],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">GraphBGP</i>":[98,128,159,179],"an":[100],"attributed":[101],"graph":[103,119,137],"integrates":[106],"node":[107],"edge":[109],"attributes.":[110],"It":[111],"intelligently":[112],"tracks":[113],"updates":[115],"refresh":[117],"efficiently.":[120],"Leveraging":[121],"enriched,":[123],"up-to-date":[124],"representation,":[125],"employs":[129],"tailored":[130],"tracing":[133],"models":[134],"grounded":[135],"in":[136],"convolutional":[138],"networks":[139],"(GCNs),":[140],"enabling":[141,197],"identification":[144],"source":[146],"tracing.":[147],"Comprehensive":[148],"experiments":[149],"with":[150],"real-world":[151],"synthetic":[153],"datasets":[154],"demonstrate":[155],"state-of-the-art":[161],"accuracy":[164],"while":[165],"significantly":[166],"reducing":[167],"inference":[168],"time,":[169],"even":[170],"under":[171],"partial":[172],"network":[174],"visibility.":[175],"Furthermore,":[176],"precisely":[180],"ASes":[185],"within":[186],"short":[188],"time":[189],"period":[190],"7":[192],"milliseconds":[193],"after":[194],"detection,":[196],"rapid":[198],"mitigation.":[199]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}