{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T07:11:13Z","timestamp":1790838673764,"version":"4.1.0"},"reference-count":133,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2017]]},"DOI":"10.1109\/comst.2016.2622240","type":"journal-article","created":{"date-parts":[[2016,10,27]],"date-time":"2016-10-27T18:11:29Z","timestamp":1477591889000},"page":"377-396","source":"Crossref","is-referenced-by-count":131,"title":["BGP Anomaly Detection Techniques: A Survey"],"prefix":"10.1109","volume":"19","author":[{"given":"Bahaa","family":"Al-Musawi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Philip","family":"Branch","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Grenville","family":"Armitage","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","article-title":"RIPE routing-WG recommendation for coordinated routeflap damping parameters","author":"barber","year":"1998"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2439"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2009.2020798"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/90.974527"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1930"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.17487\/rfc6286"},{"key":"ref37","doi-asserted-by":"crossref","first-page":"143","DOI":"10.1007\/978-3-642-19260-9_15","article-title":"Route flap damping made usable","author":"pelsser","year":"2011","journal-title":"Proc 16th Int Conf Passive Active Measur"},{"key":"ref36","author":"underwood","year":"2005","journal-title":"Internet-wide Catastrophe - Last Year"},{"key":"ref35","first-page":"43","article-title":"Detecting BGP configuration faults with static analysis","volume":"2","author":"feamster","year":"2005","journal-title":"Proc Symp Netw Syst Design Implementation (NSDI)"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2005.1541715"},{"key":"ref28","year":"2014","journal-title":"Autonomous system (AS) numbers"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.17487\/rfc6793"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4632"},{"key":"ref20","author":"brown","year":"2008","journal-title":"Pakistan hijacks YouTube"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/2479957.2479959"},{"key":"ref21","author":"simon","year":"2006","journal-title":"oof Panix Sidelined by Incompetence Again"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/icc.2011.5962883"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/2377677.2377702"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1145\/1030194.1015491"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.17487\/rfc6996"},{"key":"ref100","year":"2015","journal-title":"Archipelago measurement infrastructure"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/505202.505207"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2010.2066284"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2008.021101"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/964725.633027"},{"key":"ref57","author":"toonk","year":"2014","journal-title":"Turkey Hijacking IP Addresses for Popular Global DNS Providers"},{"key":"ref56","author":"zmijewski","year":"2014","journal-title":"Indonesia Hijacks the World"},{"key":"ref55","first-page":"115","article-title":"The BGP visibility scanner","author":"lutu","year":"2013","journal-title":"Proc IEEE Conf Comput Commun Workshops (INFOCOM WKSHPS)"},{"key":"ref54","year":"2004","journal-title":"RANCID - Really Awesome New Cisco ConfIg Differ"},{"key":"ref53","author":"huston","year":"2012","journal-title":"Leaking Routes"},{"key":"ref52","article-title":"Charter of the IETF secure inter-domain routing working group","year":"2015"},{"key":"ref40","article-title":"RIPE routing working group recommendations on route-flap damping","author":"smith","year":"2006"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/PCCC.2015.7410340"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.11.012"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SECCOM.2007.4550358"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/2398776.2398779"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2011.041010.00041"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2007.7"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2009.2034031"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/49.839934"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/1282427.1282411"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CYCON.2014.6916405"},{"key":"ref48","year":"2015","journal-title":"Micron21 DDoS Soak and Scrub as a Service"},{"key":"ref47","first-page":"353","article-title":"Analysis of BGP prefix origins during Google’s May 2005 outage","author":"wan","year":"2006","journal-title":"Proc 20th Int Parallel Distrib Process Symp (IPDPS)"},{"key":"ref42","article-title":"RIPE routing working group recommendations on route-flap damping","author":"bush","year":"2013"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.17487\/rfc7196"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5065"},{"key":"ref43","author":"white","year":"2004","journal-title":"Practical BGP"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2011.6089080"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-88623-5_40"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517965"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1145\/1005686.1005745"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2008.4575169"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/HPSR.2012.6260835"},{"key":"ref129","author":"sanfilippo","year":"2006","journal-title":"HPING"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/CATCH.2009.28"},{"key":"ref128","first-page":"367","article-title":"iPlane: An information plane for distributed services","author":"madhyastha","year":"2006","journal-title":"Proc of the 5th Symp on Oper Syst Design and Implementation (OSDI)"},{"key":"ref70","year":"2015","journal-title":"Reseaux IP Europeens Network Coordination Center"},{"key":"ref76","author":"oberheide","year":"2015","journal-title":"pybgpdump"},{"key":"ref130","author":"fyodor","year":"2006","journal-title":"NMap"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/1096536.1096542"},{"key":"ref74","article-title":"RFC 6396: Multi-threaded routing toolkit (MRT) routing information export format","author":"blunk","year":"2011"},{"key":"ref75","year":"2015","journal-title":"RIPE NCC RIS Projec bgpdump"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177100"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1109\/4236.957902"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2013.08.002"},{"key":"ref132","author":"hu","year":"2009"},{"key":"ref79","first-page":"1","article-title":"Finding a needle in a haystack: Pinpointing significant BGP routing changes in an IP network","volume":"2","author":"wu","year":"2005","journal-title":"Proc Symp Netw Syst Design Implementation (NSDI)"},{"key":"ref60","author":"bortzmeyer","year":"2009","journal-title":"Who Has AS 1712?"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2004.1378412"},{"key":"ref61","author":"madory","year":"2009","journal-title":"Bonjour Y’all! ASN Split Personalities"},{"key":"ref63","first-page":"149","article-title":"How to own the Internet in your spare time","author":"staniford","year":"2002","journal-title":"Proc 11th Usenix Security Symp"},{"key":"ref64","article-title":"Re: More on Moscow power failure (was RE: Moscow: Global power outage)","author":"roudnev","year":"2005"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2013.130616"},{"key":"ref66","first-page":"210","article-title":"Disaster’s impact on Internet performance—Case study","author":"bilski","year":"2009","journal-title":"Proc 16th Conf Comput Netw (CN)"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CATCH.2009.20"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2012.6375891"},{"key":"ref2","article-title":"RFC 4271: A border gateway protocol 4 (BGP-4)","author":"rekhter","year":"2006","journal-title":"Internet Eng Task Force"},{"key":"ref69","year":"2015","journal-title":"University of Oregon University of Oregon Route Views Project"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4593"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/18.650984"},{"key":"ref95","year":"2015","journal-title":"Bogon Report"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1145\/1557019.1557160"},{"key":"ref94","year":"2015","journal-title":"Bogon Route Server Project (Bogons via BGP)"},{"key":"ref107","author":"bloomfield","year":"2004","journal-title":"Fourier Analysis of Time Series An Introduction"},{"key":"ref93","article-title":"Specialpurpose IP address registries","author":"cotton","year":"2013"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/90.731185"},{"key":"ref92","year":"2015","journal-title":"IP to ASN mapping"},{"key":"ref105","first-page":"135","article-title":"Locating prefix hijackers using LOCK","author":"qiu","year":"2009","journal-title":"Proc 18th Conf USENIX Security Symp"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2004.1354576"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/INISTA.2011.5946083"},{"key":"ref90","year":"2015","journal-title":"APNIC Whois Database"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2005.159"},{"key":"ref102","first-page":"266","article-title":"Generalized Fisher score for feature selection","author":"gu","year":"2012","journal-title":"Proc 27th Conf Annu Conf Uncertainty Artif Intell (UAI)"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30143-1_13"},{"key":"ref112","author":"vernon","year":"1991","journal-title":"Machine Vision Automated Visual Inspection and Robot Vision"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1145\/1080173.1080189"},{"key":"ref98","year":"2015","journal-title":"IP2Location Database"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2013.2291244"},{"key":"ref96","year":"2015","journal-title":"Team Cymru-Bogon Route Announcements"},{"key":"ref97","year":"2015","journal-title":"MaxMind - GeoLite Country - Open Source IP Address to Country Database"},{"key":"ref10","article-title":"RFC 6483: Validation of route origination using the resource certificate public key infrastructure (PKI) and route origin authorizations (ROAs)","author":"huston","year":"2012","journal-title":"Internet Eng Task Force"},{"key":"ref11","first-page":"10","article-title":"Listen and whisper: Security mechanisms for BGP","author":"subramanian","year":"2004","journal-title":"Proc 1st Symp Networked Syst Design Implem (NSDI)"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2006.320179"},{"key":"ref13","first-page":"437","article-title":"NetReview: Detecting when interdomain routing goes wrong","author":"haeberlen","year":"2009","journal-title":"Proc USENIX Symp Netw Syst Design Implem (NSDI)"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/1851275.1851195"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2005.1498520"},{"key":"ref118","volume":"29","author":"elliott","year":"2008","journal-title":"Hidden Markov Models Estimation and Control"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2010.101005"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2006.1687549"},{"key":"ref117","author":"cowie","year":"2003","journal-title":"Impact of the 2003 Blackouts on Internet Communications Preliminary Report"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2009.91"},{"key":"ref81","article-title":"BGP replay tool (BRT) v0.1","author":"al-musawi","year":"2016"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24604-6_7"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379701"},{"key":"ref119","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1007\/3-540-59119-2_166","article-title":"A decision-theoretic generalization of on-line learning and an application to boosting","author":"freund","year":"1995","journal-title":"Proc 2nd European Conf on Computational Learning Theory"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637231"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.7155\/jgaa.00102"},{"key":"ref114","author":"toonk","year":"2015","journal-title":"Massive route leak causes internet slowdown"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1016\/j.physrep.2006.11.001"},{"key":"ref116","author":"witten","year":"2011","journal-title":"Data Mining Practical Machine Learning Tools and Techniques"},{"key":"ref80","article-title":"MRT dump file manipulation toolkit (MDFMT)—Version 0.2","author":"rossi","year":"2009"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2014.6848023"},{"key":"ref120","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1145\/1269899.1254890","article-title":"Diagnosing network disruptions with network-wide analysis","volume":"35","author":"huang","year":"2007","journal-title":"SIGMETRICS Perform Eval Rev"},{"key":"ref89","article-title":"Routing policy specification language (RPSL)","author":"blunk","year":"2005"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2006.52"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4471-4594-3_3"},{"key":"ref123","first-page":"1037","article-title":"Online selecting discriminative tracking features using particle filter","volume":"2","author":"wang","year":"2005","journal-title":"Proc IEEE Comput Soc Conf Comput Vis Pattern Recognit (CVPR)"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/1452335.1452337"},{"key":"ref86","first-page":"153","article-title":"PHAS: A prefix hijack alert system","volume":"15","author":"lad","year":"2006","journal-title":"Proc 15th Conf USENIX Security Symp (USENIX-SS'06)"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/1282380.1282412"},{"key":"ref88","year":"2015","journal-title":"Internet Routing Registry"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/7862305\/07723902.pdf?arnumber=7723902","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,1,12]],"date-time":"2022-01-12T16:12:03Z","timestamp":1642003923000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/7723902\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017]]},"references-count":133,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/comst.2016.2622240","relation":{},"ISSN":["1553-877X"],"issn-type":[{"value":"1553-877X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017]]}}}