# Utilizing Duplicate Announcements for BGP Anomaly Detection
## 1 Introduction  
The Exterior Gateway protocol used for interdomain routing is the BGP protocol, which constructs the foundational structure of the internet. Services that depend on the internet can suffer adversely as a result of any disruption or failure of this protocol. The occurrence of anomalies in BGP leads to malfunctioning of the operation of the protocol. The BGP anomalies can be caused by router misconfigurations, session resets, and link failures [1]. BGP anomaly detection is carried out by utilizing the data collected from RIPE and Route views downloaded from the collection site [2]. The work gives a comprehensive description of the BGP anomalies. The classification of anomalies is performed as it has a great influence on the behavior of the BGP protocol and affects the services that are disrupted due to the non-smooth functioning of the internet. However, major BGP anomalies are caused by configuration errors, malicious spreading of the worms, disruption in power, and failure occurring in the component of any hardware [3, 4, 5, 6].  
The key role of the BGP protocol is to swap the routing information and network layer reachability information among numerous Autonomous Systems (ASes). The BGP routers create a neighborship or peering after a session is initiated. The peering of the BGPacross different ASes is shown in Figure 1. The BGP protocol is vulnerable to anomalies as the occurrence of anomalies impacts connectivity issues among the ASes and losses that occur during data transmission. The detection of anomalies is still a challenging task for the research community in the area of network security [7]. Different machine learning approaches are utilized in order to track the presence of anomalies in the cyberspace domain [8]. Different performance measures are used to evaluate and assess the performance capability of the classifier. Ensemble approaches have been used by combining multiple classifiers. The contribution of the research work lies in the improvement of the performance measured from the previous work performed [9]. The following contributions are made to the research work:  
1. The exponential Moving Average (EMA) algorithm is applied to BGP datasets to identify trends and make informed decisions based on the proper analysis of the data obtained in the time series.
2. Deep Learning algorithms such as Long Short-Term Memory (LSTM) and Autoencoder are utilized, and a comparison is made for the detection of bursty announcements with the LSTM technique and the detection of duplicate announcements with the proposed autoencoder technique.
3. The handling of data imbalance is managed by the use of the Temporal-oriented Synthetic Minority Over Sampling Technique (T-SMOTE) technique.
4. The experimentation is performed when two deep learning approaches are analyzed and compared; the autoencoder has provided the best results in terms of improved performance metrics, i.e., accuracy, precision, recall, and Receiver Operating Characteristic (ROC) curve.  
The structure of the organization of the presented research article is as follows: Section 2 is focused on a review of related work performed in the area of BGP anomaly detection. Section 3 describes the proposed deep learning approach and the datasets used for evaluation. Section 4 highlights the results obtained from experimentation and performance analysis of the thoroughly carried out research work. Finally, Section 5 gives a brief conclusion obtained from the research work.  
Figure 1: BGP peering across different ASes.