# Utilizing Duplicate Announcements for BGP Anomaly Detection
## 4 Result Analysis
### Performance Comparison of DL Models
This combination of high precision and recall makes the Autoencoder model a strong candidate for real-time BGP anomaly detection, as it balances false positives and false negatives more effectively than LSTM. Figure 5 depicts the performance comparison of DL models for Accuracy, Precision, Recall, and F1-Score on the RIPE dataset. Figure 6 depicts the performance comparison of DL models for average case Accuracy, Precision, Recall, and F1-Score on the ROUTE Views dataset. Figure 5: Performance comparison between DL techniques for the RIPE dataset. From Tables 6-9 and Figures 5 and 6, it is clear that the Autoencoder model performance for all anomalies of the RIPE and ROUTE Views dataset is significantly higher than the LSTM model. So, the Autoencoder model is our proposed anomaly detection model, which has been further explored and analyzed in detail in terms of the confusion matrix and Area Under Curve (also known as (ROC). Figure 8: Confusion Matrix for the MB Anomaly for the RIPE dataset. Figure 10: Confusion Matrix for the Shammer Anomaly for the ROUTE Views dataset. Figure 9: Confusion Matrix for the WannaCrypt Anomaly for the RIPE Dataset. Figures 8 and 11 (Moscow Blackout Anomaly): Despite the difficulty owing to its intermittent disruptions, the Autoencoder keeps a greater accuracy with minimal false positives, indicating a better performance in differentiating normal BGP007 traffic flux from real disruptions. On the other hand, with LSTM, we can clearly see that it lacks precision, where normal events are treated as anomalies. Figures 9 and 12 (WannaCrypt Ransomware Anomaly): The Autoencoder shows balanced performance by a vast majority of anomalies detected correctly with low false positives and low false negatives. On the contrary, LSTM gives a higher FN, showing that it fails to take certain malicious patterns, which leads to missed anomalies in important incidents. The Autoencoder confusion matrices (all the figures) demonstrate a better balance between precision and recall that proves the model being built is successfully reducing both the false positives (FP) and false negatives (FN). Thus, the detector not only detects real anomalies but also avoids false alarms, making it ideal for real-time BGP security applications. The ROC for Slammer, Moscow blackout, and WannaCrypt anomalies of the RIPE dataset and Slammer, Moscow blackout, and WannaCrypt anomalies of the ROUTE Views dataset is shown in Figure 13, Figure 14, Figure 15, Figure 16, Figure 17, and Figure 18, respectively. Figures 13-17 show the ROC curves for the Autoencoder and LSTM model classification on a variety of different BGP anomalies over the RIPE and Route Views datasets. Figure 11: Confusion Matrix for the MB Anomaly for the ROUTE Views dataset. Figure 12: Confusion Matrix for the WannaCrypt Anomaly for the ROUTE Views dataset. Autoencoder also gets near-perfect AUC scores, as shown in Figures 13 and 16 (Slammer Worm Anomaly and RIPE and Route Views), suggesting that the detection of this large-scale  
Figure 16: ROC Curve for the Slammer Anomaly for the ROUTE Views dataset. Figure 17: ROC Curve for the MB Anomaly for the ROUTE Views dataset. Figure 18: ROC Curve for the WannaCrypt Anomaly for the ROUTE Views dataset. network disruption was highly effective. If you look at the top left corner, the curve rises steeply, and this means that you have a great true positive rate (TPR) with a low number of false positives (FPR). Compare The gradual increment in the values of the LSTM model demonstrates the weaker performance of the LSTM model in detecting anomalies. Both Figures (Figures 14 and 17) (Moscow Blackout Anomaly--RIPE And Route Views): Again, the Autoencoder outperforms LSTM, leading to a higher AUC, indicating a solid detection of intermittent routing disruptions introduced by the blackout. The steep rise in the ROC curve indicates that the Autoencoder has a good ability to separate regular and abnormal updates. Still, in contrast, LSTM has increased the rate of false positives, and therefore its reliability is low.