Abnormal BGP Routing Dynamics Detection by Sampling Approach in Decision Tree

Because of BGP´s critical importance as the de-facto Internet inter domain routing protocol, accurate and quick detection of abnormal BGP routing dynamics is of fundamental importance to Internet security, where the costs of different errors are unequal. In such situation, cost-sensitive learning is a good solution. This paper studies the effect of both over-sampling and under-sampling in training cost sensitive decision tree (C4.5). These techniques modify the distribution of the training data such that the costs of the examples are conveyed explicitly by the appearances of the examples. The results suggest that the accuracy of the detection of abnormal BGP routing dynamics is applicable to BGP products. At the same time, we emphasize that this is a promising direction to improve security, availability, reliability and performance of Internet security by detecting and preventing abnormal BGP routing dynamics traffic.