A Method for Real-Time Identification of Malformed BGP Messages

The BGP routing system is one of the key component of today's Internet infrastructure responsible for carrying data traffic across different Autonomous Systems (ASes). Recently, malformed BGP messages have become a threat to the operational community as they repeatedly cause BGP session resets until identified. However, the identification of the message itself is often difficult in large ISP networks. In this paper, we propose a novel method for real-time identification of these messages by using passively collects BGP messages. Our method focuses on the frequency of observed attributes and values of prefixes advertised by each AS. Based on our heuristics that common attributes are observed at similar time scale, we periodically measure the usage frequency of attributes from BGP messages observed in real-time and mark attributes and values used by minority of the AS as suspicious. We verify the efficiency of our method using BGP data obtained from operational networks.