Towards Identifying Large-scale BGP Events

Anomalous BGP events can deteriorate Internet performance and connectivity thus have always been a research topic. However, most measurement works in this realm are prone to monitor-local events, namely, the events local to only few BGP monitors. Besides, events that are widely observed can also have negligible impact, e.g., prefix-local events. In contrast, a Large-scale BGP Event (LBE) makes a large quantity of prefixes be updated and can be observed by a large portion of monitors. Such events are anomalous even harmful. We formulate the problem of identifying LBEs from BGP updates, then propose the Iterative Cut-oil" Algorithm to solve it. We apply the method to some famous disruptive events and some 'innocent' data, which are collected from more than 400 monitors. The measurement results validate the effectiveness of our method. Moreover, we detect a severe and persistent misconfiguration event that has remained unreported before.