  Despite the robust structure of the Internet, it is still susceptible to
disruptive routing updates that prevent network traffic from reaching its
destination. Our research shows that BGP announcements that are associated with
disruptive updates tend to occur in groups of relatively high frequency,
followed by periods of infrequent activity. We hypothesize that we may use
these bursty characteristics to detect anomalous routing incidents. In this
work, we use manually verified ground truth metadata and volume of
announcements as a baseline measure, and propose a burstiness measure that
detects prior anomalous incidents with high recall and better precision than
the volume baseline. We quantify the burstiness of inter-arrival times around
the date and times of four large-scale incidents: the Indosat hijacking event
in April 2014, the Telecom Malaysia leak in June 2015, the Bharti Airtel Ltd.
hijack in November 2015, and the MainOne leak in November 2018; and three
smaller scale incidents that led to traffic interception: the Belarusian
traffic direction in February 2013, the Icelandic traffic direction in July
2013, and the Russian telecom that hijacked financial services in April 2017.
Our method leverages the burstiness of disruptive update messages to detect
these incidents. We describe limitations, open challenges, and how this method
can be used for routing anomaly detection.
