# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 7 Survey of Anomaly Detection Techniques
Other studies have utilized FFT (among other techniques) for the specific purpose of periodicity identification, with the source cause remaining elusive; the use of an RQA may also be capable of doing so [68]. It is important that any low-parameter MVP technique identified as a candidate for advanced BGP attack detection does not forfeit these previously identified criteria. A highly accurate but computationally expensive technique remains inappropriate for BGP-speaking routers. We evaluated 41 Classical Machine Learning (ML) approaches to AD in Table 3. Examples of ML techniques are described in [69], citing the previous use of K-means and DBSCAN techniques, whilst the use of a DenStream approach was central to the anomaly detection engine, with later work reporting accuracy metrics of up to 99% [70]. In contrast, previous work using supervised learning (and a Random Forest classifier) reported a 95.71% classification accuracy, although the work had limitations such as an inability to classify forged AS paths if the attacker is a tier-1 or tier-2 AS [10]. Bayesian models have been previously described for the purpose of BGP anomaly classification, such as Naive Bayes (NB) classifiers [71]. Support Vector Machine (SVM) and Hidden Markov Model (HMM) classifiers have also been used; for example, the use of an SVM for BGP anomaly detection in significant incidents (e.g., Code Red I, Nimda, and Slammer) has been previously described [72]. Interesting work with graph features and a range of algorithms has also been conducted. For example, ref. [73] utilized the PageRank algorithm to develop a novel Ontological Graph Identification (OGI) approach for the detection of hijacks and compromised transit nodes. [PERSON]. [74] was one of the first to both utilize graph features and subsequently explore their use as ML inputs to detect anomalies in the BGP. Of the classic ML approaches evaluated in Table 3, none showed any evidence of being deployed on multiple observables to capture and quantify the group dynamics and information of collective ASs--an essential criterion for group-level high-dimensional MVP anomaly detection to improve advanced BGP attack detection. Some approaches can be used for dimensionality reductions (for example, PCA). \begin{table}
\begin{tabular}{c l l l l} \hline \hline
**Citation** & **Technique** & **AD** & **MVP** & **\#Params** \\ \hline
[74; 75; 76; 77; 78; 79; 80; 81; 82] & SVM and its variants & Y & N & \textgreater{}2 \\
[83] & NetworkSVM & N & N & \textgreater{}2 \\
[84] & PhaseSpace-SVM & N & N & \textgreater{}2 \\
[85] & Eros-SVMs & N & N & \textgreater{}2 \\
[86] & ELM, KNN, NB & Y & N & \textgreater{}2 \\
[9; 10; 73; 87] & K-means/DBscan and variants & Y & N & \textgreater{}2 \\
[88] & K-Means clustering & Y & N & \textgreater{}2 \\
[89] & K-Means & N & N & \textgreater{}2 \\
[90] & Hybrid K-Means & N & N & \textgreater{}2 \\
[91] & HMM and Tukey’s & Y & N & \textgreater{}2 \\
[92] & HDOS and others & Y & N & \textless{}2 \\
[32; 93] & PCA & Y & N & \textless{}2 \\
[94] & RobustPCA & N & N & \textless{}2 \\
[95; 96] & Winnowing & Y & N & \textless{}2 \\
[69] & DENSTREAM & Y & N & \textgreater{}2 \\
[97] & c4.5 & Y & N & \textgreater{}2 \\
[98] & MS-SVDD & N & N & \textgreater{}2 \\
[99] & sequenceMiner & N & N & \textgreater{}2 \\
[100] & NoveltyVR & N & N & \textgreater{}2 \\
[101] & SLADE-MTS & N & N & \textgreater{}2 \\
[102] & HBOS & N & N & \textless{}2 \\
[103] & PCC & N & N & \textless{}2 \\
[104] & KNN & N & N & \textless{}2 \\
[105] & SLADE-TS & N & N & \textgreater{}2 \\
[106] & XGBoost and variant & N & N & \textgreater{}2 \\
[107] & Adaptive One-Class SVM & N & \textgreater{}2 \\
[108] & RUBoost & N & N & \textgreater{}2 \\
[109] & OC-KFD & N & N & \textgreater{}2 \\ \hline \hline \end{tabular} \(\text{BGP anomaly detection}=\text{AD}\), multi-viewpoint = MVP, Yes = Y, No = N, Possibly = P.  
\end{table} 
Table 3: Classic machine learning. Artificial Neural Network (ANN) models have been used to detect a range of anomalies including Internet blackouts, leaks, and worm attacks [110].