# Utilizing Duplicate Announcements for BGP Anomaly Detection
## 4 Result Analysis
### Performance Comparison of DL Models  
The Performance comparison for deep learning models, LSTM, and Autoencoder is performed by applying the exponential moving average algorithm as shown in Tables 6-9 in the form of Accuracy, F1-score, Precision, and Recall, respectively, for RIPE and ROUTE Views BGP datasets. \begin{table}
\begin{tabular}{l l l l} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Anomalies**} & \multicolumn{2}{c}{**Accuracy (\%)**} \\ \cline{3-4}  & & **LSTM** & **Autoencoder** \\ \hline RIPE & Slammer & 49.00 & 88.60 \\ RIPE & Moscow B/o & 51.00 & 92.82 \\ RIPE & WannaCrypt & 52.00 & 50.97 \\ \hline Avg. Accuracy for RIPE & 50.66 & 77.46 \\ \hline ROUTE & Slammer & 49.00 & 89.72 \\ ROUTE & Moscow B/o & 49.00 & 97.97 \\ ROUTE & WannaCrypt & 52.00 & 49.79 \\ \hline Avg. Accuracy for ROUTE & 50.00 & 79.16 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance comparison for accuracy for both deep learning techniques. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Feature** & **Definition** & **Type** & **Category** \\ \hline
1 & Number of Announcements & Continuous & volume \\
2 & Number of Withdrawals & Continuous & volume \\
3 & Number of Announced NLRI prefixes & Continuous & volume \\
4 & Number of Withdrawn NLRI prefixes & Continuous & volume \\
5 & Average AS-PATH Length & Categorical & AS-path \\
6 & Maximum AS-PATH Length & Categorical & AS-path \\
7 & Average unique AS-PATH Length & Continuous & AS-path \\
8 & Number of Duplicate Announcements & Continuous & volume \\
9 & Number of Duplicate Withdrawals & Continuous & volume \\
10 & Number of Implicit Withdrawals & Continuous & volume \\
11 & Average Edit Distance & Categorical & AS-path \\
12 & Maximum Edit Distance & Categorical & AS-path \\
13 & Inter-Arrival Time & Continuous & volume \\
14–24 & Maximum Edit Distance \(=n\), where \(n\) = (7, 8, \(\ldots\), 17) & Binary & AS-path \\
25–33 & Maximum AS\_PATH Length \(=n\), where \(n\) = (7, 8, \(\ldots\), 16) & Binary & AS-path \\
34 & Number of IGP packets & Continuous & volume \\
35 & Number of EGP packets & Continuous & volume \\
36 & Number of Incomplete packets & Continuous & volume \\
37 & Packet size (B) & Continuous & volume \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Feature definitions. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Parameter** & **Value** & **Best Selection** \\ \hline Number of Epochs & 10, 20, 30,50 & RIPE (MB-30, S-50, WC-20) ROUTE MB-30, S-10, WC-30) \\ Batch Size & 16, 32 & RIPE (MB-16, S-32, WC-32) ROUTE (MB-32, S-16, WC-32) \\ Learning Rate & 0.001, 0.002 & RIPE (MB-0.002, S-0.002, WC-0.001) ROUTE (MB-0.001, S-0.001, WC-0.002) \\ Alpha (Calculate EMA) & 0.1, 0.3 0.4 & RIPE (MB-0.3, S-0.1, WC-0.4) ROUTE (MB-0.4, S-0.3, WC-0.4) \\ Validation Split & 0.1, 0.2, 0.3 & RIPE (MB-0.2, S-0.1, WC-0.1) ROUTE (MB-0.3, S-0.1, WC-0.1) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: List of parameters taken for DL models. Table 6 depicts the accuracy for the LSTM and Autoencoder models with an average accuracy of 50.66 and 77.46, respectively, for the RIPE dataset for hammer, Moscow blackout, and WannaCrypt anomalies. Similarly, on the Route views dataset, the average accuracy for slammer, Moscow blackout, and WannaCrypt anomaly are 50 and 79.16 for the LSTM and Autoencoder models, respectively. In Table 6, the Autoencoder achieves 92.82% accuracy for Moscow Blackout detection in RIPE datasets, while LSTM lags at 51.00%, indicating its superior capability in detecting routing disruptions caused by power failures. Table 7 depicts the accuracy for LSTM and Autoencoder models with the average F1-score of 64.66 and 85, respectively, for the RIPE dataset for slammer, Moscow blackout, and WannaCrypt anomalies. Similarly, on the Route views dataset, the average F1-score for