# BEAR: BGP Event Analysis and Reporting

arXiv: https://arxiv.org/abs/2506.04514 · HTML: https://mlsanity.com/paper/2506.04514/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 49 references that are in the map.
- First posted on arXiv 4 Jun 2025.

## Builds on (most cited first, 8 of 8)

- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [A Survey of Large Language Models](https://mlsanity.com/paper/2303.18223/) (2023)
- [A Survey on In-context Learning](https://mlsanity.com/paper/2301.00234/) (2022)
- [Can LLMs Understand Time Series Anomalies?](https://mlsanity.com/paper/2410.05440/) (2024)
- [What do LLMs need to Synthesize Correct Router Configurations?](https://mlsanity.com/paper/2307.04945/) (2023)
- [CAIR: Using Formal Languages to Study Routing, Leaking, and Interception in BGP](https://mlsanity.com/paper/1605.00618/) (2016)
- [A Multi-View Framework for BGP Anomaly Detection via Graph Attention Network](https://mlsanity.com/paper/2112.12793/) (2021)
- [Oscilloscope: Detecting BGP Hijacks in the Data Plane](https://mlsanity.com/paper/2301.12843/) (2023)

## Abstract (arXiv)

The Internet comprises of interconnected, independently managed Autonomous Systems (AS) that rely on the Border Gateway Protocol (BGP) for inter-domain routing. BGP anomalies--such as route leaks and hijacks--can divert traffic through unauthorized or inefficient paths, jeopardizing network reliability and security. Although existing rule-based and machine learning methods can detect these anomalies using structured metrics, they still require experts with in-depth BGP knowledge of, for example, AS relationships and historical incidents, to interpret events and propose remediation. In this paper, we introduce BEAR (BGP Event Analysis and Reporting), a novel framework that leverages large language models (LLMs) to automatically generate comprehensive reports explaining detected BGP anomaly events. BEAR employs a multi-step reasoning process that translates tabular BGP data into detailed textual narratives, enhancing interpretability and analytical precision. To address the limited availability of publicly documented BGP anomalies, we also present a synthetic data generation framework powered by LLMs. Evaluations on both real and synthetic datasets demonstrate that BEAR achieves 100% accuracy, outperforming Chain-of-Thought and in-context learning baselines. This work pioneers an automated approach for explaining BGP anomaly events, offering valuable operational insights for network management.