Inferring the Confidence Level of BGP-Based Distributed Intrusion Detection Systems Alarms

As the protocol that enables the global routing system of the Internet, Border Gateway Protocol (BGP) is increasingly becoming a multipurpose protocol. However, it keeps suffering from security issues regarding bogus announcements for malicious goals. Some of these security breaches are especially critical for distributed intrusion detection systems that use BGP as the underlay network for interchanging alarms. In this sense, assessing the confidence level of detection alarms transported via BGP messages is critical to prevent internal attacks. Most of the proposals addressing the confidence level of detection alarms rely on complex and time-consuming mechanisms that can also be a potential target for further attacks. In this paper, we propose an out-of-band system based on machine learning to infer the confidence level of the intrusion alarms sent using BGP headers. Tests using a synthetic data set containing the indirect effects of a widespread worm attack over the BGP network show promising results considering well-known performance metrics, such as recall, accuracy, receiver operating characteristics (ROC), and f1-score.