# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 7 Survey of Anomaly Detection Techniques
\begin{table}
\begin{tabular}{c l l l l} \hline \hline
**Citation** & **Technique** & **AD** & **MVP** & **\#Params** \\ \hline
[185] & HMM & Y & N & \(>\)2 \\
[186; 187; 188; 189; 192] & HMM variants & N & N & \(>\)2 \\
[193; 194] & DBNs & N & N & \(>\)2 \\
[195] & Interactive OD & N & N & \(>\)2 \\
[196] & FABDNBC & N & N & \(>\)2 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Stochastic learning. \begin{table}
\begin{tabular}{c l l l l} \hline \hline
**Citation** & **Technique** & **AD** & **MVP** & **\#Params** \\ \hline
[30; 40; 162] & EWMA and variants & Y & N & \(\leq\)2 \\
[164; 165] & Other EWMA variants & N & N & \(\leq\)2 \\
[163] & RQA & Y & N & \(>\)2 \\
[166] & **MRQA** & N & **Y** & \(\geq\)2 \\
[167; 168] & Kalman Filter & Y & N & \(>\)2 \\
[169] & SARIMA & Y & N & \(>\)2 \\
[170] & NIDES/STAT & Y & N & \(>\)2 \\
[171] & Heuristic algorithms & Y & N & \(>\)2 \\
[172] & Z-score & Y & N & \(\leq\)2 \\
[173] & MRCD & N & N & \(>\)2 \\
[174] & MEDIFF & N & N & \(>\)2 \\
[175] & ARFIMA/Holt-Winter & N & N & \(>\)2 \\
[176] & MGDD & N & N & \(>\)2 \\
[177] & One-sided Median & N & N & \(\leq\)2 \\
[178] & Seasonal-Hybrid ESD & N & N & \(>\)2 \\
[179] & ANODE/R-ANODE & N & N & \(>\)2 \\
[180] & RePAD2 & N & N & \(>\)2 \\
[181] & AMD & N & N & \(>\)2 \\
[182] & DCSDFOT & N & N & \(>\)2 \\
[183] & SASE/SMSE & N & N & \(>\)2 \\
[184] & PCI & N & N & \(\leq\)2 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Statistical methods. BGP attack detection capability. Among the early BGP detection works, ref. [66] is an example of the application of the FFT to BGP detection where neither the anomaly source nor cause could be identified. A DWT with Harr wavelets was used for BGP anomaly detection work in [67] on the research network Abilene, though there were detection delays left unaddressed. A wavelet Daubechies 5 (db5) wavelet transform was used in [65] to identify anomaly origins, though was shown to not be a real-time detection candidate. Wavelet transform techniques were used for BGP detection in [198]. In [199], a Singular Spectrum Analysis (SSA) and the Hilbert Huang Transformation (HHT) were applied to BGP updates, specifically to investigate the Slammer worm incident. From the studies evaluated in Table 7, no possible candidates for deployment from multiple observables to capture and quantify the group-level dynamics and information of collective ASs, with the objective of group-level high-dimensional MVP anomaly detection, were identified. There were 13 outlier detection techniques evaluated. Several distance-based and nearest neighbour-based methods were evaluated in the outlier detection category, such as local outlier factor (LOF)-based techniques (Table 8). Anomalous activity is identified as irregular subsequences that have large distance metrics from their neighbor. Sub-LOF has demonstrated precision and robustness in the literature, though it has never been applied to BGP anomaly detection [17,204]. Histogram-based Outlier Detection (HBOS) has been used for BGP anomaly detection, in addition to Isolation Forest and CBLOF, and all were similar in their anomaly detection ability [92]. We could not identify any evidence in the outlier detection schemes we evaluated of their capacity to be deployed from multiple observables to capture and quantify the group-level dynamics and information of groups of ASs. Therefore, no technique was evaluated as a candidate for the MVP detection of advanced BGP attacks. There were 28 data mining anomaly detection techniques evaluated, as seen in Table 9. As with outlier detection, both distance-based and nearest neighbor-based methods feature in data mining (e.g., the Matrix Profile family of algorithms such as HOT SAX, MPA, STAMP, and STOMP). Most of the distance-based methods evaluated were unsupervised. The Matrix Profile (MP) approach has been evaluated on hundreds of time series datasets [63,217] and has been shown to successfully detect anomalies in data with periodic characteristics, with minimal parameterization [218].