Summary

  • Among 13 synthetic BGP traffic generators, the one with highest fidelity at its own collector suffered the largest cross-collector drop: 35–41% of anomalies went undetected.
  • Motaali reports that the detector identified the April 2025 Iberian outage signal within ten minutes at a 1.3% false-alarm rate; operators independently confirmed a 65-minute episode in a blind AS766 evaluation.

Analysis

Before her PhD, Shadi Motaali worked at an ISP in Iran, where routing incidents came with customer complaints. At RIPE 93 she put the operational question bluntly: would a network notice a problem in minutes, or when a customer called? Her benchmark asks whether a BGP detector can keep its bearings when the collector changes.

The test trained on RIPE RIS RRC4 and evaluated on RRC5. Motaali used 30 documented events labeled from published timestamps and compared 13 synthetic-traffic generators. The generator with the highest fidelity at its own collector degraded most across collectors: 35–41% of anomalies went undetected. The talk names the test pair and event set; it does not quantify how many missed detections the topology step recovered on that pair.

Her feature pipeline cut 48 candidate UPDATE statistics to 25, keeping features only when six selection algorithms agreed. Fewer inputs reduced noise and shortened detection time. The detector then paired route-change statistics with an AS-level graph. A sparse or star-shaped network could use a flat classifier; a dense network needed a model that considered relationships among features. Topology changed the detector class because two peers and a hundred transit links do not behave alike.

The April 2025 Iberian power outage supplied a live check: the detector identified the event within ten minutes of its BGP signal, with a 1.3% false-alarm rate. The model had been trained five months earlier and was not retrained. In a blind evaluation on AS766 (RedIRIS), operators independently confirmed a 65-minute routing episode from timestamps alone. Motaali also described an alarm review in which operators found upstream route withdrawals, possibly from convergence, without an effect on traffic.

The reversal is the finding: the generator that looked most convincing at home was the one that lost most of the signal elsewhere. Motaali ties that risk to network shape and gives operators an explanation to inspect, not just a score to trust.

Sources