Abstract: This paper presented a novel algorithm for detecting routing path forging based on aggregation．By selecting change of AS path as the detection object,using the country which the prefix belongs to as the standard,the change of AS path was converged.The definition of AS link probability deviance,intermediate country appearance probability,and intermediate country distance deviance were introduced．Based on these metrics,we introduced path-level detecting me-trics and integrated these metrics to check routing path forging．The data of actual routing path forging event was tested by the proposed method．Experimental results demonstrate that the method is more valid and practical than previous methods.

Key words: Anomaly detection,Aggregation,Routing hijacking,Path forging, Border gateway protocol ,AS path