Leak-Detector: An Improved Route leak Detection Method
Haoyang Gao, Ning Li, Yuancheng Xie · 2024
BGP route leak represents a significant vulnerability in BGP security. The occurrence of BGP route leak can lead to increased internet latency and diminished service quality in less severe cases, and in more severe instances, it can result in large-scale regional outages or substantial traffic redirection, causing considerable financial losses to network operators and users. Thus, the ability to accurately and promptly identify route leak is of paramount importance for maintaining internet security. Current route leak detection methods typically involve a trade-off between accuracy and real-time performance, making it challenging to achieve both simultaneously. To address this issue, this paper proposes the Leak-Detector framework, which synthesizes the strengths of existing advanced methodologies. By integrating AS hegemony indicators with machine learning models, Leak-Detector provides accurate and real-time detection of route leak incidents, and it can precisely report both the suspects and the timing of the leak. Application of Leak-Detector to real-world route leak detection demonstrates that it achieves an accuracy of 85%, recall of 84%, and F1 score of 83%, with minimal detection latency. Furthermore, it accurately identifies most route leak suspects and their occurrence times.