BGP Models Missed 35–41% of Anomalies on Other Collectors

BGP Models Passed Their Home Test. They Missed 41% of the Anomalies Elsewhere

Why it matters

A RIPE-based benchmark found that the synthetic generator with the best in-sample fidelity still missed 35–41% of unseen anomalies when tested on a different collector. The model knew its neighborhood. The Internet has more than one.

Daniel Kade30 October 2026 at 20:27 UTCReading Time 2 minLast update: 30 October 2026

One collector can look familiar while another reveals what the model missed.

Summary

In the EuCNC 2026 benchmark, SMOTE_kmeans scored above 0.99 F1 in-distribution; cross-collector testing cut F1 to 0.79 and missed 35–41% of unseen anomalies.
RIPE 93 reported that AS-level topology derived from RIB snapshots improved cross-network robustness, alongside two event validations.

A model can ace the exam it helped write. The EuCNC 2026 paper “SynthBGP” compared 13 synthetic BGP traffic generators across five method families using 16 fidelity measures. SMOTE_kmeans reached 97.5% in-distribution fidelity and detector F1 above 0.99. Move evaluation to another collector and F1 fell to 0.79; false negatives on unseen anomalies reached 35–41%. A collector is one observation point, not the network. Synthetic data can reproduce its local habits without travelling well.

At RIPE 93, Shadi Motaali of Universidad Autónoma de Madrid described adding AS-level topology from RIB snapshots to UPDATE-stream statistics. The session abstract says a density-based criterion selects a model class for each network and restores robustness. It also reports two validations: a detector flagged the BGP signal associated with the April 2025 Iberian power outage within ten minutes, at 1.3% false alarms, using a model trained five months earlier without retraining; in a blind AS766 (RedIRIS) evaluation, operators independently confirmed a 65-minute routing episode from timestamps alone.

These are research results reported by the team, not evidence of a generally deployed alarm service.

The distinction matters: the EuCNC benchmark quantifies synthetic-data failure across collectors; the NOMS paper describes topology-aware generalization as a later research phase, while the newer RIPE talk reports results from that line. The sources establish no public deployment or independent replication. That is the evidence gap that would change the operational verdict. “Trained on RIPE data” is not acceptance criteria. Buyers should ask which collectors and ASes were withheld, how labels were checked and what each anomaly class’s miss rate was. A pooled score can hide the hard cases. Primary sources: EuCNC 2026 paper · RIPE 93 talk abstract · NOMS 2026 research paper · RIPE NCC RIS.