Signal Atlas / isolated learning environment

BGPKit Lab

Working examples for turning BGP observations into explainable routing-risk features. This lab does not write to Signal Atlas production paths.

BGPKit BrokerpybgpkitCloudflare RadarRPKI-aware triage

01 / Acquire

Find an MRT slice

Query BGPKit Broker for a bounded Route Views or RIPE RIS update file. The file is evidence, not an alert.

02 / Parse

Extract path features

Normalize AS_PATH, origin ASN, prefix, timestamp and announcement type before scoring. Retain raw-record provenance.

03 / Corroborate

Test the claim

Compare observed origins with Radar route and hijack evidence, including RPKI validity. A model proposes; evidence adjudicates.

LIVE / BGPKit Broker

Locate update archives

The server-side proxy exposes BGPKit discovery without credentials.

Awaiting query.

WORKING EXAMPLE / PYTHON

Forged AS_PATH candidates

pip install pybgpkit
from _pybgpkit import Parser

for elem in Parser("https://.../updates.bz2"):
    path = elem.as_path or []
    if len(path) != len(set(path)):
        print({"kind":"as_path_loop", "prefix":elem.prefix,
               "path":path, "ts":elem.timestamp})

A repeated ASN is a candidate feature, not proof of forgery. Account for prepending, confederations, and collector visibility.

WORKING EXAMPLE / FEATURE RECORD

Score evidence, not strings

{
 "observed_at":"UTC timestamp", "prefix":"203.0.113.0/24",
 "origin_asn":64500, "as_path":[64501,64500],
 "path_loop":false, "origin_changed":true,
 "rpki_validation":"INVALID", "collector_count":0,
 "evidence_refs":["mrt URL","radar event ID"]
}

Feed features—not raw paths—into Isolation Forest. Preserve deterministic constraints and analyst dispositions for training labels.

LIVE / CLOUDFLARE RADAR

High-confidence origin-hijack evidence

Results are live Radar detection evidence through a protected server-side token.

Awaiting query.

INTEGRATION TARGET / SIGNAL ATLAS

Recommended boundary

BGPKit Broker → parser job → normalized observations → feature builder
                                      ↓
Radar routes + hijacks + RPKI → evidence enrichment
                                      ↓
Signal Atlas D1 event record → analyst review / alert delivery / ML labels

Assessed fit: Signal Atlas is a scheduled Worker with D1 storage, AI, and a protected Radar token binding. Use BGPKit for acquisition and parsing; use Radar as independent corroboration; retain evidence references and feature values in the event record. A model score must not be the sole alert criterion.

OPERATING NOTES

What this lab establishes

Confirmed: BGPKit Broker supplies time-bounded MRT archive discovery without credentials. Radar returns high-confidence hijack records with origin, victims, prefixes, confidence and RPKI-related tags. Unverified: direct Forgejo source access from this node; the gateway denied authorization, so no repository-specific data model was assumed.