# Optimal Partitioning of Unbalanced Datasets for BGP Anomaly Detection
###### Abstract
Figure 1 reveals the technique of deriving sub-classes from the major classes and merging them with the minor classes for the purpose of training the ELM. Here, the first dataset is divided into five classes, \(D_{1}\) up to \(D_{5}\), whose sample counts are \(S_{1}\), \(S_{2}\), \(S_{3}\), \(S_{4}\), and \(S_{5}\), respectively. The unequal proportions of samples are illustrated by relatively more samples in \(D_{1}\), \(D_{3}\), and \(D_{5}\) compared to in \(D_{2}\) and \(D_{4}\), which separately have fewer sample counts. For achieving uniform distribution, the method starts off by computing the mean number of samples per class, which is represented by the following equation:  
\[S_{M}=\frac{\sum_{i=1}^{5}S_{i}}{5} \tag{1}\]  
Utilizing the mean sample size per class (\(S_{M}\)) as a standard comparator, the majority classes with sample counts higher than \(S_{M}\) are divided into a number of sub-classes through optimal partitioning (OP). This implies that the distribution of the samples for the unbalanced classes will be brought back to its level in the former dataset because now the dataset has over five classes. The advantage of subdividing the larger sample size classes is also illustrated in Figure 2. It is important to note that these sub-classes serve a temporary role in the classification process. They are merged back to the initial classes of the classifier before the last phase of outputting. The outcome labels of the classifier are the original input labels. The claimed contributions of this article are as follows:  
1. A novel classification method is proposed that uses optimal partitioning (OP) and the Extreme Learning Machine (ELM) for the classification and detection of anomalies in the traffic of BGP-based network environments;
2. To handle the data imbalance nature of the dataset, the majority classes are targeted for optimal partitioning using the Particle Swarm Optimization technique;
3. In the experiment, the Random Forest (RF), Support Vector Machine (SVM), Artificial Neural Network (ANN), and Extreme Learning Machine (ELM) were trained and tested on the BGP traffic dataset, namely, BGP RIPE and BGP ROUTE Views;
4. The results of the trained models were compared mutually, and it was determined that the OP-based ELM model provided the best results when different performance metrics were observed and experimentation was performed w.r.t. the accuracy, preci  
Figure 1: Class balancing process using optimal partitioning. Figure 2: Balancing of imbalanced dataset by dividing the majority sample classes into multiple sub-classes. sion, recall, and F1-score, which acted as the proposed model to identify anomalies in BGP traffic;
* A comparison of the proposed model was also conducted with other recent state-of-the-art model approaches, and it was found to be the superior performing model. The remaining organization of this article is as follows: Section 2 expresses the summary of related works as a Literature Review for BGP anomaly detection. Section 3 presents the proposed approach. Section 4 highlights the performance evaluation metrics, and in Section 5, the analysis of the results of the designed method are presented. Section 6 presents the conclusion of the paper for anomaly detection.