# Utilizing Duplicate Announcements for BGP Anomaly Detection
## 2 Related Work  
### Previous Works Nearly Related to the Current Study  
The signature-based methodologies have been presented by [PERSON] et al. [10] for the detection of anomalies present in the BGP routing incidents. Their methodology is based on the statistical model, and it utilizes five different measures to model BGP update messages. The update is received from the inter-arrival times, which include intensity as a measure. Two methodologies have discussed the advantages and limitations, and their conjunctions have been used to obtain improved system performance. [PERSON] et al. [11]. Proposed an approach based on statistics for the comprehensive detection of high-effect BGP events, which is dependent on the visibility matrix obtained from the update messages. A binary matrix where the collector data are utilized and the prefix associated with it is recorded. A heuristic algorithm is proposed as a significant contribution. The results are validated by showcasing that the identified incidents are severely correlated with the occurrence of large-scale events. [PERSON] et al. suggest a two-phase clustering approach [12] to explore anomalies present in the routing attributes. These attributes have been taken from BGP update messages discussed in the I-seismograph [13]. Their anomaly detection approach calculates normal dynamics with time. I-seismograph sends messages to those ASes who were affected mostly. It also sends messages to those AS path segments that rise considerably during an event. [PERSON] et al. [14] have described notable features of ASes. The hijacking of IP blocks is actively reported for any malicious intention. The classifier is trained to identify ASes that have the same features as those possessed by serial hijackers. The important features that are utilized for classification are that the presence of AS varies in distance, and the presence of uncertainty has also been observed in the origination bh of the prefixes. The application of signal processing has also been taken into account for the detection of BGP anomalies. A supervised learning approach has been given by [PERSON] et al. [15]. This differentiates among various anomalies in order to explore the patterns of higher order in BGP traffic. [PERSON] et al. [16] shed light on the temporal localization of the anomalies present in the BGP. [PERSON] et al. explored the anomalies present in the datasets [17] from BGP updates. They apply median filtering to search for anomalies present in these patterns. [PERSON] et al. [5] have proposed a procedure for recording the variations which are present in the features. By applying the statistical approach of pattern recognition, features from the update messages of the BGP are collected. When the internet is likely to be under strain, a wide analysis of features such as AS Path length and AS Path Edit distance is very helpful. The novelty is contributed in the area where deep learning techniques are utilized; here, time series is extracted as a feature for the detection of BGP anomalies. The concept of labeled Multi-Scale Long Short-Term Memory MS-LSTM has been suggested by [PERSON] et al. [18] for BGP anomaly detection. They have utilized Worm attacks in the time series domain to train and test their approach. The temporal data at different scales is utilized by the application of Discrete Wavelet Transform, a novel work suggested by [PERSON] et al. [19]. An autoencoder technique has been utilized by [PERSON] et al. [20] to encode a high-dimensional characterization for the detection of anomalies present in the routing data. A generation tool for the modeling of the dataset has been proposed by [PERSON] et al. [21] for the extraction of relevant message features that are obtained in BGP update messages, as well as for helping in the labeling of the data. They have emphasized volume and AS-PATH features, which are normally utilized by BGP anomaly detection approaches.