# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 4 Why the Need for Low-Parameter Computationally Efficient Techniques? This section highlights the necessity of low-parameter and computationally efficient anomaly detection techniques in BGP-speaking routers. Due to the limited computational resources, such as CPU power, memory, and energy, available in BGP routers, these devices must prioritize handling routing updates and BGP messages. Complex, parameter-heavy algorithms for anomaly detection introduce processing delays and scalability challenges, compromising the router's core functions and network performance. Lightweight and fast anomaly detection techniques are necessary to ensure timely threat identification and resilience without overburdening network infrastructure. This section emphasizes how reducing the number of parameters used in detection techniques is crucial for maintaining both speed and scalability in large-scale BGP networks. BGP-speaking routers are constrained by limited computational resources, including CPU power, memory, and energy [51; 52; 53]. These resources are primarily dedicated to han dling routing table updates and processing BGP messages. Therefore, any additional functionality, such as anomaly detection schemes, must be implemented in a resource-efficient manner to avoid compromising the router's primary functions [53; 54; 55]. The high-speed and large-scale nature of BGP-speaking networks demands fast, lightweight, and computationally efficient anomaly detection techniques to ensure timely threat identification and network resilience [56; 57]. The environment of BGP routing requires rapid decisions to ensure efficient data packet forwarding [53; 55]. Introducing complex algorithms or models for anomaly detection can lead to processing delays, affecting network performance and stability. Both the Routing Information Base (RIB) and the Forwarding Information Base (FIB) (see Figure 9) require rapid updates and lookups to adapt to changes in network topology and routing policies. Complex algorithms can extend these processing times, causing delays in routing decisions [54; 58]. In environments where latency in routing decisions is critical, heavyweight computational or parameter-heavy models can increase processing latency, undermining the timely delivery of network traffic [56]. Additionally, BGP routers operate in large-scale networks where scalability is essential. Lightweight and computationally efficient programs are preferred to ensure scalability across numerous routers without overburdening the network infrastructure [54]. Heavy computational tasks can also significantly impact energy consumption. Efficient anomaly detection techniques for BGP routers should avoid the imposition of numerous features, parameters, domain-specific tuning, and extensive training, as these can counteract the goals of speed, lightweight operation, and computational efficiency. The pressures imposed by numerous features and parameters can impact their computational complexity, resource intensiveness, latency, and response time. Introducing a multitude of features and parameters into anomaly detection algorithms elevates the computational complexity of BGP routers. Each additional feature or parameter adds to the processing overhead, potentially leading to performance bottlenecks and de  
Figure 9: BGP-speaking router control and data planes. graded throughput. This increased complexity runs counter to the objective of lightweight and nimble operation required in BGP networks [54; 56]. Domain-specific tuning and training can intensify resource demands on a BGP router. Training algorithms to recognize anomalies within the BGP-speaking routing system requires substantial computational resources and extensive datasets. Furthermore, the iterative nature of training processes demands ongoing maintenance and updates, further straining the limited resources available to BGP routers. The accumulation of features, parameters, and domain-specific tuning imparts latency and delays to the anomaly detection process [52; 56].