10/21/2003DSOM'2003, Heidelberg, Germany1 Visual-based Anomaly Detection for BGP Origin AS Change (OASC) Soon-Tee Teoh 1, Kwan-Liu Ma 1, S. Felix Wu 1, Dan Massey 2, Xiao-Liang Zhao 2, Dan Pei 3, Lan Wang 3, Lixia Zhang 3, Randy Bush 4 UC Davis, USC/ISI, UCLA, IIJ

10/21/2003DSOM'2003, Heidelberg, Germany2 Elisha: the long-term goal Monitoring and management of a large- scale complex system that we do not fully understand its behavior. Integration of human and machine intelligence to adaptively develop the domain knowledge for the target system.

10/21/2003DSOM'2003, Heidelberg, Germany3 In this talk… Knowledge Acquisition via Visualization –cognitive pattern matching –event correlation and explanation Outline –Background: Origin AS in BGP –The Elisha/OASC tool –One example and demo

10/21/2003DSOM'2003, Heidelberg, Germany4 Autonomous Systems (ASes) UCDavis: /16 AS6192AS11423 (UC) AS11537 (CENIC) AS513 an AS Path: /    6192

10/21/2003DSOM'2003, Heidelberg, Germany5 Origin AS in an AS Path UCDavis (AS-6192) owns /16 and AS-6192 is the origin AS AS Path: 513    6192 – – – – – – – – – – – Observation Points in the Internet collecting BGP AS Path Updates: RIPE: AS

10/21/2003DSOM'2003, Heidelberg, Germany6 Origin AS Changes (OASC) Ownership: UCDavis (AS-6192) owns /16 and AS-6192 is the origin AS Current –AS Path: 2914  209   6192 –for prefix: /16 New –AS Path: 2914  3011  273  81 –even worse: /24 Which route path to use? Legitimate or not?? / /24

10/21/2003DSOM'2003, Heidelberg, Germany7 BGP OASC Events (one type only) Max: (9177 from a single AS)

10/21/2003DSOM'2003, Heidelberg, Germany8 Data from BGP Observation Points

10/21/2003DSOM'2003, Heidelberg, Germany9 Anomaly Detection False positive versus false negative Anomaly analysis: –To find the “meaning”, “explanation,” and “knowledge” behind those detected anomalies

10/21/2003DSOM'2003, Heidelberg, Germany10 Visual-based Anomaly Detection “Visual” Anomalies –Something catches your eyes… Mental/Cognitive “long-term” profile or normal behavior –We build the “long-term” profile in your mind. –Human experts can incorporate “domain knowledge” about the target system/protocol.

10/21/2003DSOM'2003, Heidelberg, Germany11 Visual-based Anomaly Detection decay update clean cognitively identify the deviation alarm identification Information Visualization Toolkit raw events cognitive profile

10/21/2003DSOM'2003, Heidelberg, Germany12 ELISHA/OASC Events: –Low level events:BGP Route Updates –High level events:OASC Still per day and max per day for the whole Internet Information to represent visually: –IP address blocks –Origin AS in BGP Update Messages –Different Types of OASC Events

10/21/2003DSOM'2003, Heidelberg, Germany Qua-Tree Representation of IP Address Prefixes / /16

10/21/2003DSOM'2003, Heidelberg, Germany AS# AS# Representation AS-1 AS-7777 AS-15412

10/21/2003DSOM'2003, Heidelberg, Germany15 AS81 punched a “hole” on /16 yesterday /16 today / /24 yesterday AS-6192 today AS-81 victim offender

10/21/2003DSOM'2003, Heidelberg, Germany16 8 OASC Event Types Using different colors to represent types of OASC events C type: CSS, CSM, CMS, CMM H type: H B type: B O type: OS, OM

10/21/2003DSOM'2003, Heidelberg, Germany17 August 14, 2000 AS-7777 punched hundreds of holes.

10/21/2003DSOM'2003, Heidelberg, Germany18 April 6, 2001 AS15412 caused 40K+ MOAS/OASC events within 2 weeks…

10/21/2003DSOM'2003, Heidelberg, Germany19 April 7-10, /07/2001 all04/07/ /08/2001 all04/08/ /09/2001 all04/09/ /10/2001 all04/10/

10/21/2003DSOM'2003, Heidelberg, Germany20 April 11-14, /11/2001 all04/11/ /12/2001 all04/12/ /14/2001 all04/14/ /13/ /13/2001 all

10/21/2003DSOM'2003, Heidelberg, Germany21 April 18-19, 2001 – Again?? 04/18/2001 all04/18/ /19/2001 all04/19/

10/21/2003DSOM'2003, Heidelberg, Germany22 Remarks The Elisha/OASC prototype discovered and helped to explain real-world BGP anomalies. Integration with Statistical approaches. Elisha: open source available – –Linux/Windows