标题： BEAR: BGP事件分析与报告 显示英文标题

标题： BEAR: BGP Event Analysis and Reporting

摘要： 互联网由相互连接的自治系统（AS）组成，这些系统依靠边界网关协议（BGP）进行域间路由。BGP 异常现象——例如路由泄漏和劫持——可能会通过未经授权或低效路径引导流量，危及网络的可靠性和安全性。尽管现有的基于规则和机器学习的方法能够利用结构化指标检测这些异常现象，但仍需要具有深入 BGP 知识（例如 AS 关系和历史事件）的专家来解读事件并提出补救措施。 本文介绍了一种名为 BEAR（BGP 事件分析与报告）的新框架，该框架利用大型语言模型（LLM）自动生成全面的报告，以解释检测到的 BGP 异常事件。BEAR 使用多步推理过程，将表格形式的 BGP 数据转换为详细的文本叙述，从而增强可解释性和分析精度。 为了应对公开记录的 BGP 异常现象有限的问题，我们还提出了一种由 LLM 驱动的合成数据生成框架。在真实数据集和合成数据集上的评估表明，BEAR 实现了 100% 的准确性，优于链式思维和上下文学习基线。这项工作开创了一种自动解释 BGP 异常事件的方法，为网络管理提供了宝贵的运行洞察。 显示英文摘要

摘要： The Internet comprises of interconnected, independently managed Autonomous Systems (AS) that rely on the Border Gateway Protocol (BGP) for inter-domain routing. BGP anomalies--such as route leaks and hijacks--can divert traffic through unauthorized or inefficient paths, jeopardizing network reliability and security. Although existing rule-based and machine learning methods can detect these anomalies using structured metrics, they still require experts with in-depth BGP knowledge of, for example, AS relationships and historical incidents, to interpret events and propose remediation. In this paper, we introduce BEAR (BGP Event Analysis and Reporting), a novel framework that leverages large language models (LLMs) to automatically generate comprehensive reports explaining detected BGP anomaly events. BEAR employs a multi-step reasoning process that translates tabular BGP data into detailed textual narratives, enhancing interpretability and analytical precision. To address the limited availability of publicly documented BGP anomalies, we also present a synthetic data generation framework powered by LLMs. Evaluations on both real and synthetic datasets demonstrate that BEAR achieves 100% accuracy, outperforming Chain-of-Thought and in-context learning baselines. This work pioneers an automated approach for explaining BGP anomaly events, offering valuable operational insights for network management.