# Optimal Partitioning of Unbalanced Datasets for BGP Anomaly Detection
## 2 Literature Review  
There have been different methodologies explored by examining the stances of traffic for network anomaly detection. The most generic way is to evolve the handling of the traffic behavior by the usage of statistical-based approaches. This leads to the identification of anomalies as they are highly correlated, and in the case of any abrupt change that happens in major segmentation, is also helpful in their recognition [13; 14; 15]. The disadvantage of the mentioned cases is that it is complicated to calculate the dimensional distributions. In order to recognize the anomalies from all of the data points present in the traffic, several clustering techniques have also been articulated. The anomalous data points that pertain to a single cluster and the anomalous data points that pertain to multiple clusters are recognized from all of the data points [16; 17; 18]. Clustering methodologies come with common downsides, such as automatic cluster description generation, random starting phase sensitivity, the presence of noise and outliers, the inability to process non-convex clusters of different sizes and densities, the vaguely defined completion criteria, and the overly complicated computations for high-dimensional datasets and big data. Therefore, there is the possibility of performance deterioration in higher-dimensional space [19]. In the traditional data mining domain, the approach is based on the ruling technique [20; 21], which classifies members on the basis of a predefined set of rules and is another popular method. But its ability to detect anomalies through predefined rules is limited, and it is unable to detect unknown anomalies. Moreover, it demands a higher level of database scans to create the rules [22]. Several machine learning methodologies have also been adopted to complete this task. The completion of this task is achieved by separating it into two main parts: the first one is the unsupervised machine learning technique and the second one is the supervised machine learning technique [7]. One technique for the efficient detection of anomalies in the machine learning process is Artificial Neural Networks (ANNs) [23; 24; 25]. The strong point of neural networks is that they can detect the intricate kind of relationship between features; however, they also have many drawbacks, such as the substantial amount of data required for effective training. The training is computationally intensive and may take considerable time. The black-box nature of ANNs, which encompasses the capacity to infer how a particular decision or prediction is reached, is another feature. Additionally, ANNs are easily susceptible to overfitting, and this is a problem when the network architecture is much more complex in relation to the number of training data. As a result, the networks show poor generalization when handling new data that the networks have not encountered during the training process [26]. One of the primary SVM advantages that eliminates some of the ANN shortcomings is its ability to work with non-linear data [27]. SVMs apply the methodology of kernel functions to map the data points in the hyperplane. This is performed by the advent of a linearly distinguishable optimal hyperplane. The searching of the optimal hyperplane is performed, which distinguishes the data points linearly from the mapping space [28; 29; 30]. Different varieties of SVM detection approaches have been explored, and an evaluation of their performances is presented in [31; 32]. Besides their advantages, they also face computational problems that are complex and, hence, increase the computing time and cost. The second fact is that support vector machines are not good in training datasets with unclear class labels because they rely heavily on the correct identification of the location of the decision boundaries.