Multi-Scale LSTM Model for BGP Anomaly Classification

Research output: Journal Publications and Reviews (RGC: 21, 22, 62)21_Publication in refereed journalpeer-review

16 Scopus Citations
View graph of relations


Related Research Unit(s)


Original languageEnglish
Pages (from-to)765-778
Number of pages14
Journal / PublicationIEEE Transactions on Services Computing
Issue number3
Online published10 Apr 2018
Publication statusPublished - May 2021


As a policy-based routing protocol, the primary purpose of Border Gateway Protocol (BGP) is to exchange routing reachability information to provide sufficient end-to-end Quality-of-Service (QoS). The constant increase of anomalous traffic of BGP affects the connectivity and reachability of routing information among different Autonomous Systems (ASs), which calls for building accurate alerting models to provide stable routing services in the Internet. The previous works classify anomalies without considering the characteristic of multiple time scales, which may lead to inaccurate classification. In this paper, we propose a novel Multi-Scale Long Short-Term Memory (MSLSTM) model to capture the anomalous behaviors from BGP traffic. In our model, a Discrete Wavelet Transform is used to obtain temporal information on multiple scales, and a hierarchical two-layer LSTM architecture is devised where the first layer learns the attentions of different time scales to generate an integrated historical representation, and the second layer captures the temporal dependency in the learned representation. To evaluate the feasibility in different alerting scenarios, we conduct comprehensive experiments based on several BGP data sets collected from real world applications. The results demonstrate that our model achieves a promising performance compared with the state-of-the-art approaches.

Research Area(s)

  • Anomaly Classification, BGP, Discrete Wavelet Transform, Discrete wavelet transforms, Feature extraction, Internet, LSTM, Microsoft Windows, Multi-Scale, Routing, Time series analysis

Citation Format(s)

Multi-Scale LSTM Model for BGP Anomaly Classification. / Cheng, Min; Li, Qing; Lv, Jianming et al.

In: IEEE Transactions on Services Computing, Vol. 14, No. 3, 05.2021, p. 765-778.

Research output: Journal Publications and Reviews (RGC: 21, 22, 62)21_Publication in refereed journalpeer-review