# Utilizing Duplicate Announcements for BGP Anomaly Detection
## 4 Result Analysis
### Performance Comparison of DL Models
\begin{table}
\begin{tabular}{l l l l} \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Anomalies**} & \multicolumn{2}{c}{**F1-Score (\%)**} \\ \cline{3-4}  & & **LSTM** & **Autoencoder** \\ \hline RIPE & Slammer & 66.00 & 94.00 \\ RIPE & Moscow B/o & 65.00 & 96.00 \\ RIPE & WannaCrypt & 63.00 & 65.00 \\ \hline Avg. F1-Score for RIPE & 50.66 & 64.66 \\ \hline ROUTE & Slammer & 66.00 & 94.00 \\ ROUTE & Moscow B/o & 67.00 & 99.00 \\ ROUTE & WannaCrypt & 65.00 & 66.00 \\ \hline Avg. F1-Score for ROUTE & 50.00 & 66.00 \\ \hline \end{tabular}
\end{table} 
Table 7: Performance comparison for F1-score for both deep learning techniques. \begin{table}
\begin{tabular}{l l l l} \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Anomalies**} & \multicolumn{2}{c}{**Precision (\%)**} \\ \cline{3-4}  & & **LSTM** & **Autoencoder** \\ \hline RIPE & Slammer & 49.00 & 88.75 \\ RIPE & Moscow B/o & 48.00 & 96.79 \\ RIPE & WannaCrypt & 52.00 & 50.53 \\ \hline Avg. Precision for RIPE & 50.66 & 49.66 \\ \hline ROUTE & Slammer & 49.00 & 91.48 \\ ROUTE & Moscow B/o & 49.00 & 98.14 \\ ROUTE & WannaCrypt & 52.00 & 49.89 \\ \hline Avg. Precision for ROUTE & 50.00 & 50.00 \\ \hline \end{tabular}
\end{table} 
Table 8: Performance comparison for precision for both deep learning techniques. \begin{table}
\begin{tabular}{l l l l} \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Anomalies**} & \multicolumn{2}{c}{**Recall (\%)**} \\ \cline{3-4}  & & **LSTM** & **Autoencoder** \\ \hline RIPE & Slammer & 96.00 & 99.67 \\ RIPE & Moscow B/o & 95.00 & 95.75 \\ RIPE & WannaCrypt & 91.00 & 92.12 \\ \hline Avg. Recall for RIPE & 50.66 & 94.00 \\ \hline ROUTE & Slammer & 99.00 & 97.37 \\ ROUTE & Moscow B/o & 94.00 & 99.83 \\ ROUTE & WannaCrypt & 96.00 & 97.73 \\ \hline Avg. Recall for ROUTE & 50.00 & 96.33 \\ \hline \end{tabular}
\end{table} 
Table 9: Performance comparison for recall for both deep learning techniques. slammer, Moscow blackout, and WannaCrypt anomaly are 66 and 86.33 for the LSTM and Autoencoder model, respectively. Table 7 highlights that for the WannaCrypt anomaly, Autoencoder maintains a balanced F1-score of 65.00%, while LSTM suffers from lower performance variability, confirming the model's robustness against malware-induced traffic anomalies. Table 8 depicts the accuracy for LSTM and Autoencoder models with the average Precision of 49.66 and 78.69, respectively, for the RIPE dataset for slammer, Moscow blackout, and WannaCrypt anomalies. Similarly, on the Route views dataset, the average Precision for slammer, Moscow blackout, and WannaCrypt anomaly are 50 and 79.83 for the LSTM and Autoencoder models, respectively. Table 8 shows that Autoencoder achieved an average precision of 78.69% on RIPE datasets and 79.83% on Route Views, significantly outperforming LSTM, which only managed 49.66% and 50.00%, respectively. This higher precision indicates that the Autoencoder reduces false positives, making it more reliable for anomaly detection in BGP traffic. Notably, for the Moscow Blackout anomaly, Autoencoder reached a precision of 96.79% in RIPE and 98.14% in Route Views, proving its effectiveness in detecting sudden routing disruptions. Table 9 depicts the accuracy for LSTM and Autoencoder models with the average Recall of 94 and 95.84, respectively, for the RIPE dataset for slammer, Moscow blackout, and WannaCrypt anomalies. Similarly, on the Route views dataset, the average Recall for slammer, Moscow blackout, and WannaCrypt anomaly are 96.33 and 98.31 for the LSTM and Autoencoder models, respectively. Table 9 further confirms the model's robustness, where Autoencoder attained an average recall of 95.84% (RIPE) and 98.31% (Route Views), compared to LSTM's 94.00% and 96.33%, respectively. High recall values indicate that the Autoencoder detects nearly all actual anomalies, minimizing false negatives. Particularly, for the Slammer worm anomaly, the Autoencoder recorded 99.67% recall in RIPE datasets, showcasing its ability to capture highly volatile BGP attack patterns.