# Optimal Partitioning of Unbalanced Datasets for BGP Anomaly Detection
## 3 Proposed Approach
### Feature Analysis  
Since the information and characteristics influence the model's classification output and define the upper limit of machine learning performance. The raw BGP data needs to be converted into a set of features with clear physical or statistical significance. To convert recorded trace data into the proper format and data type, MATLAB script was used, and 37 features were extracted from the given trace files. Table 3 shows the features obtained through the extraction process. These calculated feature values were normalized before using them for training and testing purposes. The normalization transformed the features into a common range that made all the features equally important irrespective of their numeric values [42]. \begin{table}
\begin{tabular}{c c c c} \hline
**Dataset** & **Class** & **Date** & **Total Samples** \\ \hline Slammer & Anomaly & January 2003 & 7200 \\ Nimda & Anomaly & September 2001 & 8609 \\ Code Red I & Anomaly & July 2001 & 7200 \\ WannaCrypt & Anomaly & May 2017 & 11,520 \\ Moscow Blackout & Anomaly & May 2005 & 7200 \\ Normal-BCNET & Regular & – & 1440 \\ Normal-RIPE & Regular & – & 7196 \\ \hline \end{tabular}
\end{table} 
Table 1: BGP dataset details. \begin{table}
\begin{tabular}{c c c} \hline
**Anomaly Names** & **Class Labels** & **Dataset Class Instances** \\ \hline Normal & A & 2000 \\ Slammer & B & 400 \\ Nimda & C & 200 \\ Code Red I & D & 600 \\ WannaCrypt & E & 1000 \\ Moscow Blackout & F & 1000 \\ \hline \end{tabular}
\end{table} 
Table 2: Class distribution details of dataset. \begin{table}
\begin{tabular}{c c c} \hline
**Feature** & **Definition** & **Type** & **Category** \\ \hline
1 & Number of announcements & Continuous & Volume \\ \hline
2 & Number of withdrawals & Continuous & Volume \\ \hline
3 & Number of announced NLRI prefixes & Continuous & Volume \\ \hline
4 & Number of withdrawn NLRI prefixes & Continuous & Volume \\ \hline
5 & Average AS-PATH length & Categorical & AS-path \\ \hline
6 & Maximum AS-PATH length & Categorical & AS-path \\ \hline
7 & Average unique AS-PATH length & Continuous & AS-path \\ \hline
8 & Number of duplicate announcements & Continuous & Volume \\ \hline
9 & Number of duplicate withdrawals & Continuous & Volume \\ \hline
10 & Number of implicit withdrawals & Continuous & Volume \\ \hline
11 & Average edit distance & Categorical & AS-path \\ \hline
12 & Maximum edit distance & Categorical & AS-path \\ \hline
13 & Inter-arrival time & Continuous & Volume \\ \hline
14-24 & Maximum edit distance = \(n\), where \(n=(7,\ 8,\ldots,17)\) & Binary & AS-path \\ \hline
25-33 & Maximum AS\_PATH length = \(n\), where \(n=(7,\ 8,\ldots,16)\) & Binary & AS-path \\ \hline
34 & Number of IGP packets & Continuous & Volume \\ \hline \end{tabular}
\end{table} 
Table 3: Feature definitions. The role in the classification is to make a category of testing labels into predefined classes, as presented in Table 1. Firstly, the BGP network traffic data are read from dataset files. These data files contain unprocessed original data obtained from the network. The processing of these originally obtained raw data is required so as to extract the desired information, as shown in Table 3. The implementation of the proposed methodology is featured by the utilization of MATLAB script to extract the desired information and transform it into specific data types. In order to make the operation of the mathematical computation in the desired manner, the data types are converted in a relevant manner, (such as by converting the character data type, categorical data, and ASCII to Integer, Float, and Double), as desired for the operation of connected blocks. As the problem of an imbalanced dataset is taken under consideration, where the occurrence of the events of Class A are five times more than the occurrence of other classes (shown in Table 1). Therefore, the events of Class \(A\) are clustered into \(C_{A}\) numbers of sub-classes (Class \(A_{1}\) to Class \(A_{C_{A}}\)) using optimal partitioning.