The Surprising Effectiveness of LLMs in BGP Security: Mining An Unprecedented Amount of Incidents and Boosting Anomaly Detection

Abstract

Border Gateway Protocol (BGP) security is critical to Internet infrastructure, yet progress in routing anomaly detection has been limited by the scarcity of publicly available incident datasets, which contain only 18 recorded cases. We observe that public operator mailing lists, e.g., NANOG and AusNOG, contain abundant yet largely untapped reports of real-world routing anomalies. To leverage this source, we develop an LLM-assisted extraction pipeline that identifies 244 candidate incidents from historical discussion threads. After expert validation, we curate a verified benchmark containing 232 confirmed routing anomaly events, making it 11.89X larger than existing dataset. Using this benchmark, we show that existing routing anomaly detection systems generalize poorly to diverse real-world incidents. At the same time, we find that some general-purpose LLMs without routing-specific adaptation can identify a subset of routing anomalies, but their performance varies across models and remains insufficient for reliable routing anomaly detection. Motivated by this observation, we design ROUTELLM, an LLM-based routing anomaly detector that integrates BGP-semantic-aware tokenization, routing-domain adaptation, and time-aware routing evidence retrieval. Experimental results show that ROUTELLM achieves 87.13% event-level accuracy and 94.65% message-level accuracy, outperforming the strongest baselines by 55.30% and 68.50%, respectively. We open-source the verified routing anomaly benchmark, fine-tuned model, and implementation code to support future research on BGP security.