# Utilizing Duplicate Announcements for BGP Anomaly Detection
## 3 Proposed Methodology
### Exponential Moving Average  
This is a statistical-based method that is used to predict anomalies present in the BGP datasets for the data in the time series domain [40]. The standard deviation and its estimators are calculated by applying the concept of exponential moving average. EMA is designed to be applicable with irregularly distributed data available in time series for the prediction of BGP anomalies [41]. The more weight is assigned to the current observations, the more susceptible it is to the newly arrived information. This reaction of EMA is helpful in recording the current trends as soon as the event. The noise and fluctuations present in the data are reduced by a considerable margin by making the signal smooth for the analysis of the data. The adjustment of EMA can be performed by varying the smoothing factor, also called the alpha parameter. For any computation in the data stream, it is governed by the recursive equations. \[\mu(t)=\alpha y(t)+(1-\alpha)\mu(t-1) \tag{2}\]  
Here, \(\mu(t)\) denotes the exponential moving average estimate at time \(t\), \(y(t)\) denotes the value of time series at time \(t\), and \(\alpha\)\((0\leq\alpha\leq 1)\) denotes the smoothing factor parameter. The parameter of \(\alpha\) can also be characterized as \(\alpha=\frac{2}{1+\omega}\) by utilizing the window length \(\omega\). A smaller \(\alpha\) makes EMA less sensitive to recent changes (long-term smoothing), whereas a larger \(\alpha\) gives more weight to recent data points (short-term trend tracking). Therefore, in this work, it is chosen to be 0.4 which act as a tradeoff between long-term and short-term smoothing. EMA can also be expressed in terms of a weighted sum of past observations as in the following:  
\[\mu(t)=\sum_{t=0}^{t}\left(\alpha(1-\alpha)^{i}X_{t-i}\right) \tag{3}\]  
This shows how older observations contribute less due to the exponentially decaying weight factor \((1-\alpha)^{i}\). ```
Input: Time-series data \(y_{t}\), Smoothing factor \(\alpha\), Threshold \(\theta\), Window Length \(\omega\)
Output: List of detected anomalies  DEFINE FUNCTIONEMA_Event_Detection(\(y,\alpha,\ \theta,\omega\)): # Initialize EMA with first data point \(\mu_{0}=AVERAGE(y[0:\omega])\) # Store EMA values \(\mu\_series=[\mu_{0}]\) # Store detected anomaly timestamps  Anomalies = [] # Loop through the time-series data FOR \(t\) FROM \(\omega\) TO length(\(y\)): # Compute EMA using recursive formula \(\mu_{t}=\alpha\cdot y[t]+(1-\alpha)\cdot\mu\_series[t-1]\) # Store EMA value  APPEND \(\mu_{t}\) TO \(\mu_{series}\) # Compute deviation from EMA  Deviation = ABS(\(y[t]-\mu_{t}\)) # Compute mean over window Window_Mean = AVERAGE(\(y[t-\omega+1:t+1]\)) # If deviation exceeds threshold \(\theta\), classify as anomaly if Deviation > \(\theta\)\(\times\)Window_Mean: # Store timestamp of anomaly  APPEND \(t\) TO Anomalies  RETURN Anomalies, \(\mu_{series}\)
```  
**Algorithm 1**Exponential Moving Average (EMA) Event Detection Algorithm  
We chose the Exponential Moving Average (EMA) as one of our features because it is a strong trend-following indicator that can smooth out noise in time-series data and is most effective in detecting abnormalities in BGP update messages. The Algorithm 1 explains the whole process of event detecting based on EMA. Unlike traditional statistical methods such as simple moving averages (SMA) or standard deviation-based anomaly detection, exponential moving average (EMA) assigns more weight to recent observations in a sequence, enabling it to respond more rapidly to abnormal changes in BGP announcements. This characteristic renders EMA well-suited for identifying bursty duplicate announcements potentially indicative of prefix hijacking, BGP misconfigurations, and routing loops. Moreover, EMA does not need fixed threshold assumptions, making it more suitable for realistic and dynamic BGP traffic patterns.