{"id":"https://openalex.org/W2990923974","doi":"https://doi.org/10.1145/3359992.3366640","title":"Comparing Machine Learning Algorithms for BGP Anomaly Detection using Graph Features","display_name":"Comparing Machine Learning Algorithms for BGP Anomaly Detection using Graph Features","publication_year":2019,"publication_date":"2019-11-19","ids":{"openalex":"https://openalex.org/W2990923974","doi":"https://doi.org/10.1145/3359992.3366640","mag":"2990923974"},"language":"en","primary_location":{"id":"doi:10.1145/3359992.3366640","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3359992.3366640","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 3rd ACM CoNEXT Workshop on Big DAta, Machine Learning and Artificial Intelligence for Data Communication Networks","raw_type":"proceedings-article"},"type":"preprint","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://hal.science/hal-02493187","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5033205391","display_name":"Odnan Ref Sanchez","orcid":null},"institutions":[{"id":"https://openalex.org/I68947357","display_name":"Universit\u00e9 de Strasbourg","ror":"https://ror.org/00pg6eq24","country_code":"FR","type":"education","lineage":["https://openalex.org/I68947357"]}],"countries":["FR"],"is_corresponding":true,"raw_author_name":"Odnan Ref Sanchez","raw_affiliation_strings":["University of Strasbourg, France"],"affiliations":[{"raw_affiliation_string":"University of Strasbourg, France","institution_ids":["https://openalex.org/I68947357"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019583021","display_name":"Simone Ferlin","orcid":"https://orcid.org/0000-0002-0722-2656"},"institutions":[{"id":"https://openalex.org/I4210163994","display_name":"Ericsson (Finland)","ror":"https://ror.org/04vv43q89","country_code":"FI","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210163994"]},{"id":"https://openalex.org/I1306339040","display_name":"Ericsson (Sweden)","ror":"https://ror.org/05a7rhx54","country_code":"SE","type":"company","lineage":["https://openalex.org/I1306339040"]}],"countries":["FI","SE"],"is_corresponding":false,"raw_author_name":"Simone Ferlin","raw_affiliation_strings":["Ericsson Research","Ericsson Research (Finland)"],"affiliations":[{"raw_affiliation_string":"Ericsson Research","institution_ids":["https://openalex.org/I1306339040"]},{"raw_affiliation_string":"Ericsson Research (Finland)","institution_ids":["https://openalex.org/I4210163994"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040971936","display_name":"Cristel Pelsser","orcid":"https://orcid.org/0000-0001-5334-6361"},"institutions":[{"id":"https://openalex.org/I68947357","display_name":"Universit\u00e9 de Strasbourg","ror":"https://ror.org/00pg6eq24","country_code":"FR","type":"education","lineage":["https://openalex.org/I68947357"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Cristel Pelsser","raw_affiliation_strings":["University of Strasbourg, France"],"affiliations":[{"raw_affiliation_string":"University of Strasbourg, France","institution_ids":["https://openalex.org/I68947357"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5015474966","display_name":"Randy Bush","orcid":null},"institutions":[{"id":"https://openalex.org/I4387153849","display_name":"Internet Initiative Japan","ror":"https://ror.org/05c4bsk60","country_code":null,"type":"company","lineage":["https://openalex.org/I4210145792","https://openalex.org/I4387153849"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Randy Bush","raw_affiliation_strings":["Internet Initiative Japan","Arrcus (2077 Gateway Place\r\nSuite 400\r\nSan Jose, CA - United States)","IIJ - Internet Initiative Japan Research Laboratory (Japan)"],"affiliations":[{"raw_affiliation_string":"Internet Initiative Japan","institution_ids":["https://openalex.org/I4387153849"]},{"raw_affiliation_string":"Arrcus (2077 Gateway Place\r\nSuite 400\r\nSan Jose, CA - United States)","institution_ids":[]},{"raw_affiliation_string":"IIJ - Internet Initiative Japan Research Laboratory (Japan)","institution_ids":["https://openalex.org/I4387153849"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5033205391"],"corresponding_institution_ids":["https://openalex.org/I68947357"],"apc_list":null,"apc_paid":null,"fwci":3.1511,"has_fulltext":false,"cited_by_count":29,"citation_normalized_percentile":{"value":0.92607575,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"35","last_page":"41"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8236010670661926},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.6360864639282227},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5742963552474976},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5655707716941833},{"id":"https://openalex.org/keywords/border-gateway-protocol","display_name":"Border Gateway Protocol","score":0.5418842434883118},{"id":"https://openalex.org/keywords/naive-bayes-classifier","display_name":"Naive Bayes classifier","score":0.5312283635139465},{"id":"https://openalex.org/keywords/reachability","display_name":"Reachability","score":0.48912936449050903},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.46227532625198364},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.4229263365268707},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4107719659805298},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3776070475578308},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.3734055757522583},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.2137729823589325},{"id":"https://openalex.org/keywords/routing-protocol","display_name":"Routing protocol","score":0.18710744380950928},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.12632793188095093}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8236010670661926},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.6360864639282227},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5742963552474976},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5655707716941833},{"id":"https://openalex.org/C178086212","wikidata":"https://www.wikidata.org/wiki/Q11155","display_name":"Border Gateway Protocol","level":5,"score":0.5418842434883118},{"id":"https://openalex.org/C52001869","wikidata":"https://www.wikidata.org/wiki/Q812530","display_name":"Naive Bayes classifier","level":3,"score":0.5312283635139465},{"id":"https://openalex.org/C136643341","wikidata":"https://www.wikidata.org/wiki/Q1361526","display_name":"Reachability","level":2,"score":0.48912936449050903},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.46227532625198364},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.4229263365268707},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4107719659805298},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3776070475578308},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3734055757522583},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.2137729823589325},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.18710744380950928},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.12632793188095093},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C47318570","wikidata":"https://www.wikidata.org/wiki/Q8026863","display_name":"Wireless Routing Protocol","level":4,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3359992.3366640","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3359992.3366640","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 3rd ACM CoNEXT Workshop on Big DAta, Machine Learning and Artificial Intelligence for Data Communication Networks","raw_type":"proceedings-article"},{"id":"pmh:oai:HAL:hal-02493187v1","is_oa":true,"landing_page_url":"https://hal.science/hal-02493187","pdf_url":null,"source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"the 3rd ACM CoNEXT Workshop, Dec 2019, Orlando, United States. pp.35-41, ⟨10.1145/3359992.3366640⟩","raw_type":"Conference papers"},{"id":"pmh:oai:dial.uclouvain.be:boreal:268180","is_oa":true,"landing_page_url":"http://hdl.handle.net/2078/268180","pdf_url":null,"source":{"id":"https://openalex.org/S4306401902","display_name":"Digital Access to Libraries (Universit\u00e9 catholique de Louvain (UCL), l'Universit\u00e9 de Namur (UNamur) and the Universit\u00e9 Saint-Louis (USL-B))","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I95674353","host_organization_name":"UCLouvain","host_organization_lineage":["https://openalex.org/I95674353"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"pmh:oai:HAL:hal-02493187v1","is_oa":true,"landing_page_url":"https://hal.science/hal-02493187","pdf_url":null,"source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"the 3rd ACM CoNEXT Workshop, Dec 2019, Orlando, United States. pp.35-41, ⟨10.1145/3359992.3366640⟩","raw_type":"Conference papers"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G8150697960","display_name":null,"funder_award_id":"CG#1348196","funder_id":"https://openalex.org/F4320306192","funder_display_name":"Silicon Valley Community Foundation"}],"funders":[{"id":"https://openalex.org/F4320306192","display_name":"Silicon Valley Community Foundation","ror":"https://ror.org/001ader08"},{"id":"https://openalex.org/F4320307791","display_name":"Cisco Systems","ror":"https://ror.org/03yt1ez60"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W124807149","https://openalex.org/W1976246173","https://openalex.org/W1981097787","https://openalex.org/W2004824191","https://openalex.org/W2015535581","https://openalex.org/W2028902195","https://openalex.org/W2043409701","https://openalex.org/W2061272711","https://openalex.org/W2061351406","https://openalex.org/W2065130947","https://openalex.org/W2098478859","https://openalex.org/W2116453796","https://openalex.org/W2136112386","https://openalex.org/W2146697465","https://openalex.org/W2149055390","https://openalex.org/W2154053567","https://openalex.org/W2163462010","https://openalex.org/W2333538671","https://openalex.org/W2512878932","https://openalex.org/W2542543501","https://openalex.org/W2586380145","https://openalex.org/W2750543062","https://openalex.org/W2752541078","https://openalex.org/W2759601876","https://openalex.org/W2797475117","https://openalex.org/W2799960805","https://openalex.org/W2802369598","https://openalex.org/W2855955864","https://openalex.org/W2895400162","https://openalex.org/W2895447227","https://openalex.org/W2922856096","https://openalex.org/W4212774754","https://openalex.org/W4285719527","https://openalex.org/W4400879694"],"related_works":["https://openalex.org/W4367336074","https://openalex.org/W3154045278","https://openalex.org/W4379620016","https://openalex.org/W4393666307","https://openalex.org/W3210764983","https://openalex.org/W4393443811","https://openalex.org/W4367335949","https://openalex.org/W3089416646","https://openalex.org/W4396816114","https://openalex.org/W4380048833"],"abstract_inverted_index":{"The":[0],"Border":[1],"Gateway":[2],"Protocol":[3],"(BGP)":[4],"coordinates":[5],"the":[6,17,137,142,152],"connectivity":[7],"and":[8,50,61,110,130,144,147],"reachability":[9],"among":[10],"Autonomous":[11],"Systems,":[12],"providing":[13],"efficient":[14],"operation":[15],"of":[16,35,53,91,151],"global":[18,29],"Internet.":[19],"Historically,":[20],"BGP":[21,45,73,117],"anomalies":[22],"have":[23,43],"disrupted":[24],"network":[25],"connections":[26],"on":[27],"a":[28,125],"scale,":[30],"i.e.,":[31,95],"detecting":[32],"them":[33],"is":[34],"great":[36],"importance.":[37],"Today,":[38],"Machine":[39],"Learning":[40],"(ML)":[41],"methods":[42],"improved":[44],"anomaly":[46],"detection":[47],"using":[48],"volume":[49],"path":[51,118],"features":[52,70,86],"BGP's":[54],"update":[55],"messages,":[56],"which":[57,75],"are":[58,76],"often":[59],"noisy":[60],"bursty.":[62],"In":[63],"this":[64],"work,":[65],"we":[66,133],"identified":[67],"different":[68,92],"graph":[69,138],"to":[71,114],"detect":[72,116],"anomalies,":[74],"arguably":[77],"more":[78],"robust":[79],"than":[80],"traditional":[81],"features.":[82],"We":[83,120],"evaluate":[84],"such":[85],"through":[87],"an":[88,149],"extensive":[89],"comparison":[90],"ML":[93,153],"algorithms,":[94],"Naive":[96],"Bayes":[97],"classifier":[98,154],"(NB),":[99],"Decision":[100],"Trees":[101],"(DT),":[102],"Random":[103],"Forests":[104],"(RF),":[105],"Support":[106],"Vector":[107],"Machines":[108],"(SVM),":[109],"Multi-Layer":[111],"Perceptron":[112],"(MLP),":[113],"specifically":[115],"leaks.":[119],"show":[121],"that":[122],"SVM":[123],"offers":[124],"good":[126],"trade-off":[127],"between":[128],"precision":[129],"recall.":[131],"Finally,":[132],"provide":[134,148],"insights":[135],"into":[136],"features'":[139],"characteristics":[140],"during":[141],"anomalous":[143],"non-anomalous":[145],"interval":[146],"interpretation":[150],"results.":[155]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":8},{"year":2020,"cited_by_count":1}],"updated_date":"2026-03-28T08:17:26.163206","created_date":"2025-10-10T00:00:00"}