# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 5 Why the Need for a Group-Level AS Anomaly Detection Technique? This section highlights the importance of group-level anomaly detection techniques in capturing the collective information and dynamics of interconnected ASs within a BGP system. Understanding multi-viewpoint group dynamics will be important for detecting advanced BGP attacks, which often exploit single-observable detection systems. Current BGP anomaly detection methods are limited by their focus on individual AS observables. To effectively detect sophisticated attacks that avoid public routing infrastructure, next-generation techniques must analyze the interactions and dynamics of multiple ASs simultaneously. From the coordinated movements of flocks of birds and schools of fish to the collective behaviors of human groups, understanding group-level information and behaviors is an active area of research [60]. Ongoing research endeavors aim to develop holistic approaches that consider the interactions and interdependencies among entities at the group level, enabling a deeper understanding of complex system behaviors. The effective detection of advanced attacks across the vast BGP-speaking Internet also necessitates capturing the collective dynamics of interconnected ASs. Parallels can be drawn from natural phenomena to complex, dynamic, and networked computer systems, such as the inter-domain-routed Internet. In each case, the challenge lies in deciphering the intricate dynamics that emerge from interactions among individual entities within the collective. Insight into collective behaviors extends beyond natural phenomena. In quantum error correction and aperiodic tilings, researchers have shown that grasping the global properties of complex systems requires analyzing collective dynamics, rather than focusing solely on local details [61]. For example, examining a small portion of an aperiodic tiling, such as a Penrose tiling (or Ammann-Beenker tiling), presents a challenge in the inference of the overall structure or properties of the entire tiling from that small portion alone. The local arrangement of the tiles does not provide sufficient information to deduce their global structure due to the complex and non-repetitive nature of aperiodic tilings [61]. Similarly, in Quantum Error-Correcting Codes (QECCs), researchers have identified that observing or interacting with only a small part of the quantum system (such as a qubit or a few qubits) may not yield a comprehensive insight into the entire encoded quantum information or the overall state of the system [61]. The challenge arises because the encoded quantum information is spread across the entire system in a highly entangled manner, and local measurements do not reveal the full extent of the encoded information. Consider a busy city small, where each individual represents an AS, and their interactions mirror the exchanges between ASs (e.g., BGP messages). A performer begins an impromptu show, representing a BGP incident (e.g., a leak or hijack). The reactions among the individuals are varied and complex: some stop to watch, others move away, a few start recording the event, some call others over, and a few might even join the performance. Individuals experience physiological changes in response to the event, such as increased heart rates, pupil dilation, and changes in galvanic skin response. These diverse reactions can be likened to the different BGP features extracted from incident data and used for BGP anomaly detection, such as the number of announcements, withdrawals, and average AS path length. Analyzing these reactions using standard techniques that focus on single AS observables--even if these individual reactions are correlated--offers a fragmented view of the overall situation. It is comparable to trying to understand the full impact of the performance by looking at only one group of individuals.