# Optimal Partitioning of Unbalanced Datasets for BGP Anomaly Detection
###### Abstract  
The Internet plays a vital role in the exchange of information in society. Maintaining the security and robustness of the Internet anomaly detection in Border Gateway Protocol (BGP) traffic is very important so that stable routing services can be ensured. The existing solutions are based on the classical machine learning (ML) models, which need to be advanced. In this study, a revolutionary technique that utilizes the Extreme Learning Machine (ELM) to enhance the detection of anomalies in the dynamic environment of the Border Gateway Protocol (BGP), particularly when faced with highly imbalanced class distributions, was used. The combination of imbalanced class distribution and BGP's dynamic nature often leads to the suboptimal performance of classifiers. Our proposed solution aims to address this imbalance issue by dividing the dominant classes into multiple sub-classes. This division is achieved through optimal partitioning (OP), which involves segmenting the samples from the majority class into different segments to approximate the size of the minority class. As a result, diversified classes are created to train the ELM classifier. In order to assess the effectiveness of the proposed (OP-ELM) model, the RIPE and BCNET datasets were utilized. These trace files were processed using MATLAB to extract and organize the necessary features, thereby generating suitable datasets for analysis, which are referred to as Dataset-1 and Dataset-2. The experimental findings exhibit noteworthy improvements in performance when contrasted with prior methodologies, thereby highlighting the efficacy of our innovative approach in tackling the obstacles associated with anomaly detection in BGP networks. critical challenge for BGP anomaly detection. Several different methods are used to detect BGP anomalies, as shown in [6; 7; 8]. However, the current methods for anomaly detection are based on using disproportionately imbalanced traffic data, an issue that cannot be overlooked. Furthermore, these techniques do not account for the changing conditions of networks' environments. The result is inconsistency in data classification and data from time to time, adversely affecting the effectiveness of anomaly detection systems [9]. The methodology that proposes to tackle this issue should be capable of not only effectively learning from such imbalanced databases but also of adapting to the network dynamics by keeping a sufficient gap between the examples and the classifier decision boundaries. The present article proposes a classification method based on the optimal partitioning (OP) and Extreme Learning Machine (ELM) [10] techniques for the identification of BGP anomalies with improved performance. The proposed method provides a practical solution to dataset imbalance by splitting classes with greater numbers of samples into several segments of smaller-sized subgroups and thereby making the distribution of samples even across the dataset. This segmentation is achieved through the use of OP, which facilitates classifying the samples from large classes into disconnected clusters, each of which is similar in size to the class with fewer samples. This approach leads to a more even distribution of the detection of anomalies inside BGP networks. The original concept for dividing samples from majority sample classes is taken from [11]; however, in this work, we extended the concept by applying the partitioning to multiple classes with higher numbers of samples. Furthermore, instead of using affinity propagation (AP) for partitioning the samples in this work, the optimal partitioning (OP) method based on Gray Wolf Optimization (GWO) [12] was utilized. Through this approach, classes with larger samples (major classes) are split into multiple clusters, and the clusters are assigned unique class IDs, which essentially makes them distinct sub-classes. These sub-classes together with the original classes with small numbers of samples (minor classes) are used for the Extreme Learning Machine (ELM) training.