# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 8 Advanced BGP attack Detection Candidates
### Multidimensional RQA  
As noted in previous sections, BGP routers have been successfully modeled as nonlinear dynamical systems and have the characteristics of determinism, periodicity, and recurrence. Based on these and other similar characteristics, it has been shown that an RQA can detect different types of BGP anomalies [11; 16; 68]. Standard RQA has been established as an effective near-real-time anomaly detection metric, but reported similar limitations as all methods deployed from a single observable. However, multidimensional RQA (MdRQA) is a candidate that can potentially be deployed to capture collective AS interactions and dynamics information for the purpose of MVP anomaly detection, and one that provides a quantitative multidimensional technique for the dynamical system that is BGP and the complex environment that is the Internet. MdRQA is assumption-free and has been shown to be robust and non-stationary in outlier challenges. While standard RQA measurements have shown indications of a detection capability, they have limitations [68]. MdRQA is an established technique that allows researchers to investigate how groups differ from one another in terms of their dynamics [166]. As the multidimensional variant of RQA, the use of MdRQA for groups involves embedding multiple time series into a phase space. Whilst other correlation variants exist, it has been shown that such techniques are not capable of capturing important information and dynamics at the system level [166; 249]. This simple correlation of dyadic relationships does not capture the truth of the dynamics of the group. MdRQA can capture and quantify higher-dimensional dynamics, which drives our hypothesis about BGP anomaly detection. We posit that the use of MdRQA may improve standard RQA measurements for the purposes of capturing group dynamics and information, as shown in previous work with groups of people [166]. The Recurrence Rate (RR) is the probability that the system recurs (e.g., the density of recurrence) (Equation (1)). The determinism measurement (DET) is a predictability measure based on the diagonal lines of recurrence points and the percentage of recurrence points that form those structures (Equation (2)). Lines will differ depending on the system. For example, chaotic systems will produce shorter lines and periodic systems longer lines. The maximum length (MaxL) is that of the diagonal structure formed by adjacent recurrent points (Equation (3)). The average length of these diagonal structures (MeanL) is formed by their recurrent points (i.e., the mean time trajectory segments are close to each other) (Equation (4)). We leave a rigorous examination of all other RQA measurements to future work and summarize the metrics used in this exploratory work as follows:  
* The Recurrence Rate (RR) is the probability that the system recurs. \[RR=\frac{1}{N^{2}}\sum_{i,j=1}^{N}R_{ij},\] (1)
* The determinism measurement (DET) is a predictability measure based on the diagonal lines of recurrence points and the percentage of recurrence points that form those structures. \[DET=\frac{\sum_{l=l_{\min}}^{N}lP(l)}{\sum_{l=l}^{N}R_{ij}},\] (2)  
Figure 10: MP leader–follower dynamics for BGP detection. * The maximum length (MaxL) of the diagonal structure formed by adjacent recurrent points. \[MaxL=\max(l_{i};i=1,\ldots,N_{l}),\] (3)
* The average length of the diagonal structures (MeanL) formed by recurrent points or the mean time trajectory segments that are close to each other. \[MeanL=\frac{\sum_{l=l_{\min}}^{N}l\,P(l)}{\sum_{l=l_{\min}}^{N}P(l)},\] (4)  
It is hypothesized that anomaly detection metrics are improved by analyzing ASs as groups in higher dimensions, in contrast to inferring multidimensional dynamics from single observables. As MdRQA captures the multidimensional dynamics of a group of ASs, this may allow for high-dimensional anomaly detection with higher fidelity.