# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 7 Survey of Anomaly Detection Techniques  
This section provides an in-depth survey of 178 anomaly detection techniques, focusing on their capacity to detect advanced BGP attacks through MVP and parameter scope analyses. These techniques are evaluated based on their computational efficiency, parameter scope, and ability to analyze group-level AS information and dynamics. This review categorizes these approaches into seven distinct groups, including machine learning, deep learning, and signal analysis, identifying potential candidates for next-generation BGP anomaly detection that meet the MVP criteria and are capable of detecting advanced attacks that exploit visibility limitations and complex interactions across multiple ASs. Prior approaches to determining the characteristics for next-generation BGP anomaly detection (AD) relied upon detecting and identifying the anomaly type and its source [62]. We add MVP as a requirement for next-generation AD and develop a taxonomy for advanced BGP attack detection techniques which is split into seven categories--Classic Machine Learning, deep learning, data mining, outlier detection, signal analysis, statistics, and stochastic learning--in a similar way to how [17] grouped time series anomaly detection methods generally. Previous work has examined whether a technique can handle time series data, uses control plane or data plane data, is univariate or multivariate, can differentiate between types of BGP anomalies, identifies anomaly source networks, and detects attacks in real time [62]. While we do incorporate these criterion into the collection of our sample, we also evaluate these anomaly detection techniques for evidence of the following:  
* Their parameter scope;
* Their ability to be deployed using groups of multiple observable ASs;
* Their ability to identify how the peers in a group of ASs are similar or different, how they interact with each other, and extant group-level AS dynamics;
* Their ability to capture and quantify the group interactions, dynamics, and information about collective ASs, with the objective of the group-level high-dimensional MVP anomaly detection of multiple observables (i.e., advanced BGP anomaly detection). Previous research extensively reviewing hundreds of time series anomaly detection techniques has found that, on average, each algorithm requires the tuning of approximately seven distinct parameters [63; 64]. In this context, we define a low parameter scope as \(\leq\)2 parameters. Techniques requiring fewer parameters are not only computationally more efficient but also reduce the risk of overfitting, making them more suitable for real-time BGP anomaly detection. Studies on BGP anomaly detection are often dominated by approaches that involve numerous features, parameters, and domain-specific tuning. While these methods may yield high accuracy, they contribute significantly to unacceptable computational costs, which are impractical for deployment in BGP routers. As outlined in Section 4, the impact of additional parameters on the BGP's routing performance has been well documented. Techniques with a lower parameter scope are necessary to meet the speed and efficiency demands of real-time anomaly detection in BGP networks. Any approach to BGP anomaly detection possesses strengths and limitations. Detection techniques can be highly accurate, may detect a wide spectrum of anomalies, and may identify the source of an anomaly; yet despite achieving any (or all) of these aspects, they might be limited by speed. For example, some time series approaches using wavelet transforms have shown promise in locating the source of an anomaly; however, they have also proven to be slow [65]. Other studies have sought to identify the source of an anomaly. For example, ref. [66] applied Fast Fourier Transform (FFT) techniques to nine months of BGP data but was unable to identify the source. Two studies using Wavelet techniques (db5 and Haar) successfully identified the source cause [65; 67].