Ilmu Komputer & AI editorial
Open AccessOA2026
The Surprising Effectiveness of LLMs in BGP Security: Mining An Unprecedented Amount of Incidents and Boosting Anomaly Detection
An LLM-assisted pipeline expands the verified routing anomaly benchmark 11.89X and introduces ROUTELLM, achieving 87.13% event-level accuracy.
Libin Liu; Wenzhou Yang; Li Chen; Dan Li; Xiuting Xu· 2026· DOI 10.48550/arXiv.2608.22812
The core problem
Border Gateway Protocol (BGP) security is critical to Internet infrastructure, yet progress in routing anomaly detection has been limited by the scarcity of publicly available incident datasets, which contain only 18 recorded cases. This scarcity hampers the development and evaluation of robust detection systems. The authors observe that public operator mailing lists, such as NANOG and AusNOG, contain abundant yet largely untapped reports of real-world routing anomalies. To address the dataset gap, they develop an LLM-assisted extraction pipeline that identifies 244 candidate incidents from historical discussion threads. After expert validation, they curate a verified benchmark containing 232 confirmed routing anomaly events, making it 11.89X larger than existing datasets. Using this benchmark, they show that existing routing anomaly detection systems generalize poorly to diverse real-world incidents. At the same time, they find that some general-purpose LLMs without routing-specific adaptation can identify a subset of routing anomalies, but their performance varies across models and remains insufficient for reliable routing anomaly detection. Motivated by this observation, they de
Innovation
The experimental results demonstrate the effectiveness of ROUTELLM. On the verified benchmark of 232 routing anomaly events, ROUTELLM achieves 87.13% event-level accuracy and 94.65% message-level accuracy. These results outperform the strongest baselines by 55.30% and 68.50%, respectively. The baselines include existing routing anomaly detection systems and general-purpose LLMs without routing-specific adaptation. The significant improvement highlights the benefits of integrating BGP-semantic-aware tokenization, routing-domain adaptation, and time-aware routing evidence retrieval. Additionally, the authors open-sourced the benchmark, fine-tuned model, and implementation code to facilitate future research.
Border Gateway Protocol (BGP) security is critical to Internet infrastructure, yet progress in routing anomaly detection has been limited by the scarcity of publicly available incident datasets, which contain only 18 recorded cases. This scarcity hampers the development and evaluation of robust detection systems. The authors observe that public operator mailing lists, such as NANOG and AusNOG, contain abundant yet largely untapped reports of real-world routing anomalies. To address the dataset gap, they develop an LLM-assisted extraction pipeline that identifies 244 candidate incidents from historical discussion threads. After expert validation, they curate a verified benchmark containing 232 confirmed routing anomaly events, making it 11.89X larger than existing datasets. Using this benchmark, they show that existing routing anomaly detection systems generalize poorly to diverse real-world incidents. At the same time, they find that some general-purpose LLMs without routing-specific adaptation can identify a subset of routing anomalies, but their performance varies across models and remains insufficient for reliable routing anomaly detection. Motivated by this observation, they design ROUTELLM, an LLM-based routing anomaly detector that integrates BGP-semantic-aware tokenization, routing-domain adaptation, and time-aware routing evidence retrieval. Experimental results show that ROUTELLM achieves 87.13% event-level accuracy and 94.65% message-level accuracy, outperforming the strongest baselines by 55.30% and 68.50%, respectively. The authors open-source the verified routing anomaly benchmark, fine-tuned model, and implementation code to support future research on BGP security.
The methodology comprises three main components: dataset construction, baseline evaluation, and the design of ROUTELLM.
Why it matters
The study reveals that the scarcity of incident datasets has been a major bottleneck in BGP security research. By leveraging LLMs to mine operator mailing lists, the authors significantly expanded the available data, enabling more robust evaluation and development of detection systems. The poor generalization of existing systems underscores the need for approaches that can handle diverse real-world incidents. The finding that general-purpose LLMs can detect some anomalies but are insufficient for reliable detection motivates the need for domain adaptation. ROUTELLM addresses this by incorporating BGP-specific semantics and temporal evidence retrieval. The high accuracy achieved by ROUTELLM suggests that LLMs, when properly adapted, can be highly effective for routing anomaly detection. The open-sourcing of the benchmark and model will likely accelerate progress in BGP security. Future work could explore extending the approach to other routing protocols and integrating real-time detection capabilities.
Who should read this
CS practitioners and researchers
Opening member content…