# Median Absolute Deviation for BGP Anomaly Detection
## 2 Materials and Methods
### Methodology
#### 2.1.1 BGP Anomaly Definition  
In the context of the BGP, defining what constitutes an anomaly is especially challenging due to the protocol's complexity and the variety of operational behaviors it supports. Essentially, anomalous behavior in this context refers to any operational activity that diverges from, or adversely affects, the principal objective of the protocol. This objective is to facilitate the efficient and seamless exchange of Network Reachability Information (NRI) between various networks, ensuring optimal network interoperability and connectivity. Such deviations from the expected behavior can significantly compromise the protocol's functionality and network performance [21]. This broad definition includes a range of activities, from less efficient but harmless routing choices to deliberate attacks on the network infrastructure. Detecting anomalies in BGP is not always straightforward; for example, route flapping might lead to long-term instability, which is a potential sign of an anomaly, while traffic engineering efforts could cause short-term instability. The difficulty lies in determining which actions are harmful or beneficial to BGP's operational goals. Expanding on the classification system proposed by [PERSON] et al., BGP anomalies can be grouped into four main types: indirect, direct intended, direct unintended, and link failure [1]. An indirect anomaly occurs when an external harmful activity, like a worm attack or ransomware, indirectly disrupts BGP stability by overloading routes or causing an increase in BGP messages. Although these attacks do not directly target BGP, they can still lead to significant instability. For instance, a malware attack aimed at internet components such as web servers can generate a traffic overload, thereby impacting the ability of BGP routers to handle regular route updates. On the other hand, direct intended anomalies are those that intentionally take advantage of BGP vulnerabilities for malicious purposes, potentially redirecting traffic from legitimate Autonomous Systems to unauthorized ones. This anomaly includes all of the different types of hijacking. Meanwhile, direct unintended anomalies typically refer to misconfigurations, which can cause problems like route leaks or blackholes. These misconfigurations, usually unintentional, can lead to serious issues, such as disrupting network paths or causing packet loss. Finally, link failure anomalies occur when there is a breakdown in the connections between Autonomous Systems, often due to external events like cable breaks or power outages, leading to widespread instability in the network. In this research, we focus on specific anomalous events detailed in Table 1. This table offers a concise summary of all the anomalies, organizing them by their classification and the dates of occurrence as documented in the existing literature. For incidents such as Nimda, CodeRed 1 v2, and Slammer, the dates of occurrence are drawn from the research by [PERSON] et al. [4], with times recorded in GMT, which is equivalent to UTC for our purposes. The dates for the TMnet incident are sourced from Cisco's BGPMon, also reported in UTC [22]. The analysis of the Moscow blackout, derived from the research by [PERSON] et al. [21] and the study by [PERSON] et al. [23], presents a detailed hourly narrative of the event. However, the time zone of the reported times is not specified. Given this uncertainty, we have assumed that these times were in MSK and have accordingly adjusted them to UTC to maintain consistency within our research. In the subsequent subsection, we will provide the data processing steps of our study. Following this, we will present a thorough explanation of the technique employed in our research. This will include an in-depth discussion of the median absolute deviation (MAD) methodology, its application within our anomaly detection framework, and the rationale behind choosing a specific threshold value and time duration.