# Utilizing Duplicate Announcements for BGP Anomaly Detection
## 3 Proposed Methodology
### Deep Learning Techniques
#### 3.6.2 AutoEncoder  
This is primarily used as an unsupervised machine learning technique that learns different patterns in data. The autoencoder architecture is represented in Figure 4. The main function of the encoder is to take the input data and press the data till it reaches the hidden state. Meanwhile, it extracts the main and relevant features from the data. The reading and learning process of the decoder recreates the small dimensional auxiliary compressed data by rendering it to its initial actual size [46]. The logic behind differentiating among anomalies in the approach is to retain the data that is being compressed and make a comparison with the input data. For example, if any input dataset \(x\) has undergone compression, the mapping of the input to a smaller-order dimensional dataset \(f(x)\) is given by Equation (10).  
\[z=f(x) \tag{10}\]  
In the above equation, \(z\) denotes the primary features present in the input dataset. During the process of compression, those features are now extracted. The operational function is denoted by \(f(x)\), which involves compression of the dataset. The input data are denoted by \(x\). In order to catch the nonlinear features present in the data, which is given as input to the neural network, Rectified Linear Unit (_ReLU_) is applied. The activation functions, such as _sigmoid_, _Tanh_, or _ReLU_, do not suffer from the vanishing gradient problem, especially for larger input values. Hence, _ReLU_ can be commonly used as activation fun.  
Figure 3: LSTM architecture.  
In order to store the surface data that have undergone compression, the following equation is given: (11).  
\[xt=g(z) \tag{11}\]  
The equation mentioned above \(x^{\prime}\) is representing the data under compression that are now corrected by the decoder. \(g(z)\) is responsible for the re-creation of the compressed data \(x\) and \(x^{\prime}\) are used to get the reconstruction error. The reconstruction error can be minimized by the training of the autoencoder model and is mentioned below in Equation (12).  
\[Reconstruction\ Error=\|x-x^{\prime}\|^{2} \tag{12}\]  
Details of the autoencoder and LSTM configuration parameters adopted during the experimental analysis are shown in the Tables 2 and 3, respectively.  
\begin{table}
\begin{tabular}{l l} \hline
**Parameter Name** & **Parameter Value** \\ \hline Input Layer & 37 neurons (one per extracted feature) \\ Encoder Layer 1 & 128 neurons, ReLU activation \\ Encoder Layer 2 & 64 neurons, ReLU activation \\ Encoder Layer 3 & 32 neurons, ReLU activation \\ Encoder Bottleneck Layer & 16 neurons, linear activation \\ Decoder Layer 1 & 32 neurons, ReLU activation \\ Decoder Layer 2 & 64 neurons, ReLU activation \\ Decoder Layer 3 & 128 neurons, ReLU activation \\ Decoder Output Layer & 37 neurons, sigmoid activation (for reconstruction) \\ Learning rate & 0.001 (tuned via grid search) \\ Optimizer & Adam \\ Batch size & 32 \\ Number of epochs & 30 \\ Loss function & Mean Squared Error (MSE) \\ Dropout rate & 0.2 (to prevent overfitting) \\ \hline \end{tabular}
\end{table}
Table 2: Autoencoder Configuration Details.  
Figure 4: Autoencoder architecture.  
The reason for employing the Autoencoder instead of conventional supervised and unsupervised methods for anomaly detection is due to its ability to learn an optimal representation of normal BGP behavior and detect anomalies using a reconstruction error mechanism, eliminating the need for massive, labeled datasets.