# Optimal Partitioning of Unbalanced Datasets for BGP Anomaly Detection
## 3 Proposed Approach
### Optimal Partitioning (OP)
Also, the \(WSS\), \(BSS\), and \(P\) are calculated as follows:  
\[WSS=\sum_{k=1}^{N}\sum_{x\in C_{k}}\|x-\mu_{k}\|^{2} \tag{3}\]  
where \(C_{k}\) is the set of points in cluster \(k\), and \(\mu_{k}\) is the centroid of cluster \(k\);  
\[BSS=\sum_{k=1}^{N}n_{k}\|\mu_{k}-\mu\|^{2} \tag{4}\]  
where \(n_{k}\) is the number of points in cluster \(k\), and \(\mu\) is the overall mean of the data;  
\[P=variance(\{n_{1},n_{2},\ldots,n_{N}\}) \tag{5}\]  
where \(n_{k}\) is the number of points in cluster \(k\);  
Algorithm Steps:  
1. Initialization: Generate an initial population of gray wolves (solutions). Each wolf's position represents a potential set of centroids for the \(N\) clusters. 2. Fitness Evaluation: Calculate the fitness of each wolf using the Equation (2), the higher \(F\) values indicate better solutions. 3. Update Alpha (\(\alpha\)), Beta (\(\beta\)), and Delta (\(\delta\)) Wolves: Identify the best three solutions based on their fitness, assigning them as the \(\alpha\), \(\beta\), and \(\delta\) wolves, representing the best (\(X_{\alpha}\)), second-best (\(X_{\beta}\)), and third-best (\(X_{\delta}\)) solutions, respectively and are demonstrated in Figure 3.  
The wolves update their positions towards the prey (optimal solution), influenced by the positions of the \(\alpha\), \(\beta\), and \(\delta\) wolves that are presented in Figure 3.  
The position update can be represented as follows, where \(t\) is the current iteration:  
\[ \begin{array}{l}\overset{\rightarrow}{D}_{\alpha}=\left|\overset{\rightarrow }{C}_{1}\cdot\overset{\rightarrow}{X}_{\alpha}(t)-\overset{\rightarrow}{X}(t )\right|\\ \overset{\rightarrow}{D}_{\beta}=\left|\overset{\rightarrow}{C}_{2}\cdot \overset{\rightarrow}{X}_{\beta}(t)-\overset{\rightarrow}{X}(t)\right|\\ \overset{\rightarrow}{D}_{\delta}=\left|\overset{\rightarrow}{C}_{3}\cdot \overset{\rightarrow}{X}_{\delta}(t)-\overset{\rightarrow}{X}(t)\right|\\ \end{array}  \tag{6}\]  
\[ \begin{array}{l}\overset{\rightarrow}{X}_{1}=\overset{\rightarrow}{X}_{ \alpha}(t)-\overset{\rightarrow}{A}_{1}\cdot\overset{\rightarrow}{D}_{\alpha} \\ \overset{\rightarrow}{X}_{2}=\overset{\rightarrow}{X}_{\beta}(t)-\overset{ \rightarrow}{A}_{2}\cdot\overset{\rightarrow}{D}_{\beta}\\ \overset{\rightarrow}{X}_{3}=\overset{\rightarrow}{X}_{\delta}(t)-\overset{ \rightarrow}{A}_{3}\cdot\overset{\rightarrow}{D}_{\delta}\\ \end{array}  \tag{7}\]  
\[\overset{\rightarrow}{X}(t+1)=\frac{\overset{\rightarrow}{X}_{1}+\overset{ \rightarrow}{X}_{2}+\overset{\rightarrow}{X}_{3}}{3} \tag{8}\]  
where \(X(t)\) denotes the position of the current wolf, while \(X_{\alpha}(t),~{}X_{\beta}(t)\), and \(\overset{\rightarrow}{X}_{\delta}(t)\) are the positions of the alpha, beta, and delta wolves (centroids of the best solutions), respectively. \(\overset{\rightarrow}{C}_{1},\overset{\rightarrow}{C}_{2}\), and \(\overset{\rightarrow}{C}_{3}\) are the coefficient vectors for controlling the distance, and \(\overset{\rightarrow}{A}_{1},\overset{\rightarrow}{A}_{2}\), and \(\overset{\rightarrow}{A}_{3}\) are the coefficient vectors for controlling the influence of the alpha, beta, and delta positions on the current wolf's position. The coefficient vectors \(A_{i}\) and \(C_{i}\) are calculated as follows:  
\[A_{i}=2a\cdot r_{1}-a \tag{9}\]  
\[C_{i}=2\cdot r_{2} \tag{10}\]  
where \(\overset{\rightarrow}{a}\) linearly decreases from 2 to 0 over iterations, and \(\overset{\rightarrow}{r}_{1}\) and \(\overset{\rightarrow}{r}_{2}\) are random vectors in [0, 1]. 1. Termination: repeat the optimization loop until the stopping criterion is met (e.g., maximum iterations (\(T\)) or minimal change in fitness);
2. Result: The final positions of the alpha wolf represent the centroids of the clusters that optimally partition the data according to the given \(N\). The cluster assignments reflect  
Figure 3: An illustration of the GWO position updating process.