# A Survey of Advanced Border Gateway Protocol Attack Detection Techniques
## 7 Survey of Anomaly Detection Techniques
The application of Recurrent Neural Networks (RNNs) for BGP hijack detection has been previously described in the literature [111]. There have been extensive investigations of RNNs and the BGP, such as Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), and Broad Learning System (BLS) approaches, which have been previously utilized for their ability to classify time series data [112; 113]. As we detail in Section 8, of the 55 evaluations in Table 4, only Federated Learning (FL) has demonstrated some evidence that it could be deployed from multiple observables to capture AS information with the potential for high-dimensional anomaly detection from collective ASs. However, it remains unclear whether FL would capture information on the group dynamics of ASs, identifying how these peers are similar or different, how they interact with each other, and extant group-level AS dynamics. We evaluated 26 statistical pattern recognition approaches, as shown in Table 5. A number of studies used techniques such as the Exponentially Weighed Moving Average (EWMA), Generalized Likelihood Ratio Test (GLRT), and a Principal Component Analysis (PCA)-powered subspace approach. For example, the use of a PCA-based subspace method with BGP volume extraction was successful in the detection, identification, and differentiation of BGP anomalies, though its router configuration requirements showed that it was prohibitive to real-time detection [161]. PCA has also been combined with EWMA and GLRT with some success [162]. BGP routers have been described as having the characteristics of determinism, periodicity, and recurrence [16; 68; 163]. Based on these and other similar characteristics, it has been successfully shown that a Recurrence Quantification (RT)-powered subspace approach is also used to detect the change in the  
+++ ==WARNING: Truncated because of repetitions==
tion Analysis (RQA) can detect different types of BGP anomalies in near real time [11; 16; 68]. We have identified the multidimensional variant of an RQA as a possible candidate for deployment from multiple observables to capture and quantify the group-level interactions, dynamics, and information of collective ASs, with the objective of the group-level high-dimensional MVP detection of advanced BGP attacks. We expand on this assessment in Section 8. We evaluated 13 papers that used stochastic learning techniques (Table 6). In both the LaserDBN and Multi Hidden Markov Model (MultiHMM) techniques, the anomaly score is formed from a subsequence likelihood index based on probabilistic models. While MultiHMM is also a semi-supervised technique that builds the model from a normal training time series, it was shown to perform well in terms of run-time against unsupervised techniques. The use of HMMs combined with classic ML techniques has been applied to detect BGP anomalies, though they did not appear capable of identifying the location of the source anomaly. [PERSON] [185] applied HMMs to BGP anomaly detection, but like all stochastic learning techniques it did not demonstrate any evidence that it would be capable of multiple observable deployments to capture and quantify group-level AS dynamics and information, with the potential for the group-level high-dimensional MVP anomaly detection of advanced monitor-evasive BGP attacks. There were 10 signal analysis approaches evaluated, five of which were applied to BGP AD, as shown in Table 7. In DWTMLEAD, pre-processing is achieved through a discrete wavelet transform (DWT) and similarly to a MultiHMM approach; the anomaly value is produced from a subsequence log-likelihood [197]. Spectral Residual (SR) and FFT are two unsupervised signal analysis methods that produce an anomaly measure from the discrepancy between reconstructed subsequences and originals. Neither of these have been applied to BGP detection nor do they show any evidence of an advanced MVP