Abstract: BGP(Border Gateway Protocol) serves as the de facto standard for inter-domain routing,facilitating global connectivity among autonomous systems(AS) across the Internet.However,the absence of a built-in validation mechanism allows malicious hijacking or misconfigurations to propagate rapidly across the inter-domain network,causing large-scale Internet outages and significant economic losses.Although security mechanisms such as the resource public key infrastructure(RPKI) have been proposed,their effectiveness remains limited by the deployment rate of route origin validation among ASes.Existing approaches typically detect route anomalies by extracting graph-based features.However,these approaches suffer from high computational complexity during feature extraction and require long observation windows,which introduce significant delays in graph updates and hinder real-time anomaly detection.To address these limitations,this paper proposes AnomLoc,an online,multi-view neighborhood perturbation-aware method for BGP anomaly detection and localization.AnomLoc constructs neighborhood views from hierarchical,geographical,and topological perspectives to capture perturbations in routing updates.Based on these views,AnomLoc accurately detects and localizes anomalies by evaluating whether newly introduced links in routing updates significantly deviate from the historical normal behavior of an AS.Real-world BGP data covering seven verified BGP anomaly events is gathered in experiments.Experimental results demonstrate that AnomLoc effectively detectsall test events,with an average detection latency of less than three minutes.Compared with existing feature-based methods,AnomLoc reduces the average number of false positives per event by 0.4~9.1.

Key words: Autonomous systems, Border Gateway protocol, Inter-domain routing security, Multi-view, Anomaly detection