# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 8 Advanced BGP attack Detection Candidates
### Multidimensional RQA
Previous work has shown that MdRQA captures the higher fidelity dynamics of a system (e.g., time series of \(X\), \(Y\), and \(Z\) concurrently) as opposed to s standard (unidimensional) RQA, which is based on an approximation of a single dimension (e.g., \(X\), or \(Y\), or \(Z\)) [166]. In contrast to a standard RQA, its multidimensional variant can incorporate multiple observables to be used as dimensions in the phase space, obtained from the group (or group of systems) being analyzed. While the technique has been successful in quantifying the group dynamics of people, it has never been applied to groups of computer-controlled devices before now. Imagining the same busy city mall, where people represent ASs and their interactions symbolize BGP messages, we can further explore the dynamics using the scenario of [PERSON], a malicious character planning to disrupt the flow of people within the mall. [PERSON], representing a malicious AS (ASM), spreads false information about a celebrity giveaway, analogous to a BGP hijack where a false IP prefix is announced. [PERSON] (AS1) immediately travels towards the supposed event, representing an increase in BGP announcements. [PERSON]'s heart rate increases while texting friends about the news, similar to an increase in BGP volume. [PERSON] (AS2), skeptical, continues on his usual path, representing stability in the AS path length. [PERSON] (AS3) verifies the information, experiences physiological changes, and checks with others before deciding to change her route, analogous to BGP withdrawals and re-announcements. Using a standard RQA, individual reactions provide us with specific insights (Figure 11); [PERSON]'s actions signal an anomaly through increased announcements and volume, [PERSON]'s cautious behavior shows withdrawals and re-announcements, and [PERSON]'s stable path shows no noticeable anomalies. However, the standard RQA misses subtle changes and the broader pattern of group interactions. Using MdRQA, the focus shifts to collective dynamics. [PERSON]'s reaction influences [PERSON] and [PERSON], causing a common that catches [PERSON]'s attention. MdRQA captures these subtleties, detecting anomalies much earlier by analyzing collective behaviors. The method reveals hidden patterns and connections, enabling the more effective detection of advanced BGP attacks. MdRQA provides a comprehensive understanding of how misinformation (a BGP hijack) propagates through the network (mall). Anomalies are detected by analyzing group dynamics, capturing their collective impact rather than isolated incidents. This approach quantifies group information and interactions, leading to earlier anomaly detection. In the context of the BGP, MdRQA allows for the simultaneous observation and analysis of multiple ASs, capturing the complex interplay between them. This multi-observational capacity is crucial, reflecting the reality of BGP operations in a complex, distributed system. Addressing visibility limitations is increasingly important, given recent descriptions of advanced BGP attacks that exploit these vulnerabilities [15]. MdRQA is capable of capturing the dynamics of a single multidimensional system and capturing information on the group dynamics between different systems [166; 249]. Consider the Lorenz Attractor (Figure 12) as an example where the multidimensional dynamics of a single chaotic multidimensional system can be inferred from a single observable [166]. For example, the diagonal line structures and metrics of MdRQA, such as the average diagonal line length (MeanL) and longest diagonal line length (MaxL), are shown to be longer for the MdRQA in contrast to RQA metrics [166]. RQA metrics can be consistently improved when a system is quantified in contrast to a single observable (Table 10). This is an example of MdRQA's capacity to incorporate multiple observables as opposed to inferring the dynamics from a single observable. Table 10 shows that MdRQA quantifies the system's dynamics and outperforms a standard RQA in the majority of the RR, DET, MeanL, and MaxL metrics.