Suspicious autonomous system path detection

1. A computing-device implemented method, comprising:

obtaining, by a processor and from a Border Gateway Protocol (BGP) speaker, a list of autonomous system paths (AS-paths);

selecting, by the processor, an AS-path from the list of AS-paths;

determining, by the processor, a suspicion score for the AS-path, the suspicion score being based on a comparative analysis of connectedness of each autonomous system in the AS-path, the determining including:

determining an origin degree for each autonomous system in the AS-path;

comparing the origin degree of a first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path; and

summing percentage increase values determined by comparing the origin degree of the first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path;

comparing, by the processor, the suspicion score to a threshold value; and

providing, by the processor, an indication that the AS-path is a suspicious AS-path when the suspicion score exceeds the threshold value.

2. The method of claim 1 , where the list of AS-paths includes information from a BGP routing table, and where the method further comprises:

storing, in a memory accessible by the computing device, the list of AS-paths.

3. The method of claim 1 , where the connectedness of each autonomous system in the AS-path is based on an origin degree for each autonomous system, the origin degree comprising a total number of distinct originating autonomous system numbers (ASNs) for all BGP table entries for a the autonomous system.

4. The method of claim 1 , where, when summing the percentage increase values, percentage decrease values and zero values are excluded.

5. The method of claim 1 , where the suspicion score provides a relative indication of a level of suspicion for the AS-path.

6. The method of claim 1 , where the indication of the suspicious AS-path comprises an automatically generated message to an operator associated with the computing device.

7. The method of claim 1 , where the indication of the suspicious AS-path comprises an automatically generated message to an operator associated with a last hop autonomous system in the AS-path.

8. The method of claim 1 , where each of the AS-paths in the list of AS-paths includes an autonomous system number (ASN) for a particular autonomous system associated with a service provider.

9. A device comprising:

a memory to store instructions and an autonomous system path (AS-path); and

a processor to execute the instructions in the memory to:

determine an origin degree for each autonomous system in the AS-path,

compare the origin degree of a first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path,

sum percentage increase values determined by comparing the origin degree of the first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path to determine a suspicion score for the AS-path,

compare the suspicion score to a threshold value, and

provide an indication of a suspicious AS-path when the suspicion score exceeds the threshold value.

10. The device of claim 9 , where the AS-path includes a plurality of autonomous system numbers (ASNs) forming a route from a service provider operating the system.

11. The device of claim 9 , where the suspicious AS-path indication comprises an automatically generated message to a network device associated with a service provider.

12. The device of claim 9 , where the processor further executes instructions in the memory to:

obtain, from a network device utilizing Border Gateway Protocol (BGP), a list of autonomous system paths (AS-paths) that include an autonomous system number (ASN) for a particular autonomous system; and

select the AS-path from the list of AS-paths.

13. The device of claim 9 , where percentage decrease values and zero values determined by comparing the origin degree of the first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path are excluded when summing the percentage increase values.

14. The device of claim 9 , where the suspicion score provides a relative indication of a level of suspicion for the AS-path.

15. A method, comprising:

obtaining, by a server device from a network device implementing Border Gateway Protocol (BGP), a list of autonomous system paths (AS-paths), where each AS-path in the list of AS-paths includes an autonomous system number (ASN) for a particular service provider;

determining, by the server device, an origin degree for each autonomous system in each of the AS-paths;

comparing, by the server device, the origin degree of each first hop autonomous system in each AS-path with each subsequent hop autonomous system in the same AS-path;

determining a suspicion score for each AS-path in the list of AS-paths based on the comparing, the determining including:

comparing the origin degree of a first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path; and

summing percentage increase values determined by comparing the origin degree of the first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path; and

alerting the particular service provider of a suspicious AS-path when one of the suspicion scores exceeds a threshold value.

16. The method of claim 15 , where each of the suspicion scores provides a relative indication of a level of suspicion for each AS-path.

17. A system, comprising:

one or more devices to execute instructions, stored in a memory, to:

determine connectedness for each autonomous system in an AS-path, where the connectedness of each autonomous system in the AS-path is based on an origin degree for each autonomous system, the origin degree comprising a total number of distinct originating autonomous system numbers (ASNs) for Border Gateway Protocol (BGP) table entries for a particular autonomous system;

determine a suspicion score based on the connectedness, the one or more devices, when determining the suspicion score, being further to:

determine an origin degree for each autonomous system in the AS-path;

compare the origin degree of a first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path; and

sum percentage increase values determined by comparing the origin degree of the first adjacent autonomous system in the AS-path with each subsequent autonomous system in the AS-path; and

provide an indication of a suspicious AS-path if the suspicion score exceeds a threshold value.

18. The system of claim 17 , where the one or more devices are further to execute instructions to:

block data traffic over the AS-path if the suspicion score exceeds the threshold value.

19. The system of claim 17 , where the indication of the suspicious AS-path comprises an automatically generated message to an operator associated with one of the one or more devices.

20. The system of claim 17 , where the one or more devices are further to execute instructions to:

exclude percentage decrease values and zero values when summing the percentage increase values.