BGP + Traffic Anomaly Detection — Now with CAD Compositional Fusion

BGP routing incidents — prefix hijacks, route leaks, MOAS conflicts, fat-finger ASN typos — silently redirect traffic through hostile paths before any conventional monitoring tool notices. RoutePulse’s anomaly engine watches 56+ distinct anomaly types across 18 detectors, spanning BGP routing, traffic patterns, ML-driven behavioural analysis, and network management. v4.32 adds the Compositional Anomaly Detector (CAD): a per-(host, peer-class, hour-bucket) baseline engine that delivers 90 % noise reduction on multi-modal hosts — the firewalls, hypervisor clusters, and replication endpoints that aggregate z-score gets wrong every single hour.

CAD recognises that an aggregate z-score on a FortiGate with 11 interfaces (outside / inside / DMZ × 4 / IPSec / HA-Sync / mgmt) collapses 11 different normal behaviours into one meaningless mean — producing ~100 % false positives whenever any single mode shifts. CAD decomposes the aggregate via a 10-class peer classifier and detects via KL-divergence plus per-suspect-class spikes. Combined with smart severity classification (CRITICAL only for AS202032 / own prefixes; WARNING for DFZ-generic events), 99.8 % scope-filter noise reduction, and per-type cooldowns from 5 min to 60 min, the system finally lets operators focus on genuine incidents. Learn more on the dedicated CAD page.

CAD — Compositional Anomaly Detector

Implemented in composition-anomaly-detector.ts with peer-classifier.ts 10-class peer-class taxonomy (transit_isp, ixp_peer, ixp_route_server, internal_lan, dmz, ipsec_tunnel, ha_sync, mgmt, monitoring, unknown). Per-(host, peer_class, hour_bucket) EWMA baselines live in host_class_baseline. Detection via KL divergence between observed vs baseline composition plus per-suspect-class volume spikes. Triple-gate severity: (1) semantic — dominant-shifted class must be in suspect list for this role’s profile; (2) volume floor — critical requires ≥1 MB observed bytes; (3) direction guard — obs/baseline < 0.2 is collapse not attack, downgrade. 16 PROFILE_* constants (PROFILE_OUTSIDE_WAN, PROFILE_HA_HEARTBEAT, PROFILE_DMZ_DB…) encode per-zone expectations.

18 BGP-specific detection types

MOAS (Multi-Origin AS) conflicts with whitelist for legitimate anycast, subprefix hijacks, AS-PATH loops, route leaks (RFC 7908), bogon announcements, private ASN leaks, ASPA-invalid paths (RFC 9234), IXP LAN leaks, ROA flips, mass withdrawals, peer flaps, and fat-finger typo detection that catches single-digit ASN transcription errors (AS29596 vs AS2959). Confidence scoring 0–100 incorporates RPKI status, local-ASN involvement, CAIDA relationship validation, ASPA data, and fat-finger pattern matching.

Traffic + behavioural anomalies

16 traffic anomaly types: spikes, drops, capacity thresholds, visibility drops, peer-volume shifts. 42 configurable ML flow rules across 8 MITRE behavioural categories: scanning, brute-force, DDoS, exfiltration, C2 communication, lateral movement, protocol abuse, reconnaissance. Per-type cooldowns 5–60 minutes prevent alert fatigue; 5-minute peer-reconnection grace period suppresses restart false positives.

Key Capabilities

• 56+ anomaly types across 18 detectors covering BGP routing (18 types), traffic (16 types), ML behavioural (8 categories), CAD compositional
• CAD compositional fusion (v4.32.24+): per-(host, peer-class, hour-bucket) EWMA baselines with KL-divergence + per-suspect-class spikes
• 10-class peer classifier (peer-classifier.ts): transit_isp, ixp_peer, ixp_route_server, internal_lan, dmz, ipsec_tunnel, ha_sync, mgmt, monitoring, unknown
• 16 PROFILE_* constants encoding per-zone expected/suspect peer-class profiles (PROFILE_OUTSIDE_WAN, PROFILE_HA_HEARTBEAT, etc.)
• Triple-gate severity (v4.32.56): semantic gate + volume floor (≥1 MB) + direction guard — 90 % critical-incident reduction
• BGP detections: MOAS, subprefix hijack, AS-PATH loop, route leak (RFC 7908), bogon, private ASN leak, ASPA invalid (RFC 9234), IXP LAN leak
• Fat-finger typo detection catches single-digit ASN transcription errors (AS29596 vs AS2959)
• 42 configurable ML flow rules across 8 MITRE categories: scanning, brute-force, DDoS, exfiltration, C2, lateral movement, protocol abuse, reconnaissance
• Confidence scoring 0–100 incorporating RPKI status, local-ASN involvement, CAIDA relationship, ASPA, fat-finger patterns
• Smart severity: CRITICAL only when AS202032 or own prefixes (185.54.80.0/22) involved; WARNING for DFZ-generic events
• 99.8 % FP reduction via scope filtering (local vs. all mode) plus CAD 90 % on multi-modal hosts
• Per-type cooldowns 5–60 min (5 min loop/MOAS, 60 min looped-ASN); 5-min peer-reconnect grace period
• MOAS whitelist for legitimate multi-origin scenarios (Cloudflare anycast, multi-homed CDNs)
• Real-time processing from BMP/BGP streams with 5-minute grace after initial RIB dump
• Closed-loop ML learning: anomalies → Claude (ANIE) analysis → auto-generated tuning rules → operator approval workflow

Engineered and operated by the GOLINE SOC & Network Engineering team.

Explore all RoutePulse features →