A three-step dynamic threshold method to cluster BGP updates into routing events

Abstract

In order to better understand BGP dynamics, a time-based approach has been developed to cluster BGP updates into routing events. Its basic idea is to cluster consecutive BGP updates of the same prefix into one routing events if the updates are separated by a time interval less than a threshold. Most of static threshold methods might incorrectly group multiple events into one if the threshold is too high, or divide a single event into multiple ones if the threshold is too low. On the other hand, previous dynamic threshold approach did not present a persuasive way to calculate one of its key parameters. In this paper we present a three-step dynamic threshold method to cluster BGP updates into routing events. We evaluate our approach using updates of BGP beacon prefixes downloaded from Route Views. The experiment result shows that our dynamic threshold approach could cluster updates into routing events more precisely than previous methods, and thus improve the accuracy of the BGP measurement studies.