When BGP Goes MAD: Multi-Scale Anomaly Detection in Internet Routing#

Authors: Justin Loye, Romain Fontugne (IIJ Research Laboratory), Esteban Bautista (Univ. Littoral Cote d'Opale, LISIC)

• Why: Outage and route-leak detection that operators could actually run — near real-time, unsupervised, and without large training datasets — has been a persistent gap. This is a credible attempt to close it.
• What: MADBGP, an anomaly-detection pipeline combining (i) a temporal-graph modeling of the AS-level Internet, (ii) QuickRIB, a scalable tool for generating temporal graphs from public BGP data, and (iii) an extension of the MAD temporal-graph anomaly-detection method to weighted graphs, applied to real BGP anomalies for the first time. On ten major BGP events (outages and route leaks at different scales), it reportedly significantly outperforms IODA's BGP results. (from abstract only)
• How: Unsupervised, multi-scale detection over a temporal graph representation of the AS-level Internet built from public BGP feeds, operating near real-time.
• Where applicable: Network operators and researchers monitoring global routing health; consumes public BGP data, so no special vantage required. The outperformance claim is relative to IODA's BGP stream on selected events — validate on your own telemetry before operational reliance.