Abstract: BGP is one of the most widely used Inter-domain Routing Protocol nowadays, but the routing anomaly disturbs the normal protocol behaviors badly. By making use of network resource existed, the monitor of Inter-domain Routing System doesn’t need to change any protocols in existence, so it can be easily expanded and deployed. Detecting Engine for BGP anomaly plays an important role in BGP routing monitoring. We adopt the dynamic forming technique of detecting-links to get a well expansibility on detecting types in Single-View, and propose a BGP anomaly detecting algorithm based on multiple views, which can increase the efficiency by looking for related result-set and accelerating the search speed based on the index of views. The experiment results show that the engine performs well in the detecting based on topology and routing states, and get a preferable effect on MOAS conflicts detecting.

摘要： BGP是Internet域间路由协议事实上的标准，但是路由异常会严重干扰正常的BGP协议行为。域间路由监测利用现有网络资源对路由行为进行检测，具有扩展性好、部署方便以及不需对现有协议修改等特点，并能将监测结果用于路由配置的改进。异常检测引擎是域间路由监测系统的重要组成部分，本文采用动态的检测链生成技术在实现单视图中异常检测功能的同时提高了检测类型的扩展性，并提出一种基于相关数据集的快速定位和视图分类索引的异常检测算法提高了多视图检测的效率。实验表明，检测引擎在基于网络拓扑结构和路由状态的异常检测方面能力突出，并对多源冲突路由具有较好的检测效果。