The Surprising Effectiveness of LLMs in BGP Security: Mining An Unprecedented Amount of Incidents and Boosting Anomaly Detection
2026-08-24 • Networking and Internet Architecture
Networking and Internet Architecture
AI summaryⓘ
The authors noticed that public mailing lists from internet operators have many reports of routing problems that were not used before. They created a system using large language models (LLMs) to find and verify 232 real routing anomaly events, which is much larger than previous datasets. They found that existing detection tools don't work well on these diverse problems, and general LLMs can only partially identify them. So, they built ROUTELLM, a specialized LLM-based tool that combines internet routing knowledge and timing information to detect anomalies better. Their tool performed much better than other methods, and they shared their data and code for others to use.
Border Gateway Protocol (BGP)Routing anomalyLLM (Large Language Model)NANOGAusNOGRouting anomaly detectionBGP securityTokenizationBenchmark datasetEvent-level accuracy
Authors
Libin Liu, Wenzhou Yang, Li Chen, Dan Li, Xiuting Xu
Abstract
Border Gateway Protocol (BGP) security is critical to Internet infrastructure, yet progress in routing anomaly detection has been limited by the scarcity of publicly available incident datasets, which contain only 18 recorded cases. We observe that public operator mailing lists, e.g., NANOG and AusNOG, contain abundant yet largely untapped reports of real-world routing anomalies. To leverage this source, we develop an LLM-assisted extraction pipeline that identifies 244 candidate incidents from historical discussion threads. After expert validation, we curate a verified benchmark containing 232 confirmed routing anomaly events, making it 11.89X larger than existing dataset. Using this benchmark, we show that existing routing anomaly detection systems generalize poorly to diverse real-world incidents. At the same time, we find that some general-purpose LLMs without routing-specific adaptation can identify a subset of routing anomalies, but their performance varies across models and remains insufficient for reliable routing anomaly detection. Motivated by this observation, we design ROUTELLM, an LLM-based routing anomaly detector that integrates BGP-semantic-aware tokenization, routing-domain adaptation, and time-aware routing evidence retrieval. Experimental results show that ROUTELLM achieves 87.13% event-level accuracy and 94.65% message-level accuracy, outperforming the strongest baselines by 55.30% and 68.50%, respectively. We open-source the verified routing anomaly benchmark, fine-tuned model, and implementation code to support future research on BGP security.