# Median Absolute Deviation for BGP Anomaly Detection
## 3 Results
### Performance Evaluation  
To evaluate the performance of our model, we used accuracy and precision as metrics. Accuracy evaluates the overall correctness of a model, measuring the proportion of correct identifications (both true positive and true negative values) over the total number of observations. Precision, on the other hand, measures the ability of a model to identify how many of the detected anomalies were actually true anomalies. The formula for calculating accuracy is given by  
\[\text{Accuracy}=\frac{TP+TN}{TP+TN+FP+FN}\]  
Figure 8: Implementing MAD for anomaly detection over Nimda Attack: visual representation of Announcements and Withdrawals volumes over time with anomalies marked in pink and high-activity occurrence periods in green. Figure 7: Implementing MAD for anomaly detection over Moscow Blackout: visual representation of Announcements and Withdrawals volumes over time with anomalies marked in pink and high-activity occurrence periods in green. The formula for calculating precision is given by  
\[\text{Precision}=\frac{TP}{TP+FP}\]  
where the terms \(TP\) (True Positives), \(TN\) (True Negatives), \(FP\) (False Positives), and \(FN\) (False Negatives) have been defined earlier in this document. The following table gives a summary of the results of each of the anomaly events with their respective accuracy and precision values. The table below (Table 4) provides a detailed summary of our method's performance evaluation across the different previously analyzed anomaly events, showcasing the respective accuracy and precision metrics for each. The performance evaluation analysis across various anomaly events provides important insights into the method's efficacy. For the TMnet Misconfiguration, both the accuracy and precision metrics stand at almost 96%; similarly, the CodeRed 1 v2 Worm attack, obtained an accuracy of 95% and a precision of 94.9%. For these two events, a strong balance between accuracy and precision is demonstrated, highlighting the method's consistent reliability in detecting true anomalies while minimizing false alarms. The Slammer and Nimda Worm events showcases an exceptional precision rate of 100% and 97.8%, respectively, indicating that every anomaly detected during these events was a true anomaly. However, its accuracy stands at 88.5% for Slammer and 80% for Nimda, suggesting that while the detection was highly precise, it might have missed detecting some true anomalies. In the Moscow Blackout scenario, the method demonstrated robust accuracy at 96.1% and a precision of 87.8%. This demonstrates the model's ability to detect true anomalies but also indicates that a small proportion of identified anomalies were not true anomalies. Having observed our model's performance, it is important to examine its impact, especially regarding false positives (FP)--a critical challenge in cybersecurity. False positives occur when normal, non-anomalous activities are incorrectly flagged as threats, leading to wasted resources, operational inefficiencies, and alert fatigue among security personnel. Mirimizing these false alarms is essential for operational efficiency and ensuring real threats are addressed. Our study emphasizes precision--the ratio of true positives to all positive predictions--to assess how well the model identifies actual anomalies. However, precision alone does not account for the model's ability to correctly ignore normal events. Here is where specificity is useful. Defined as the ratio of true negatives to the sum of true negatives and false positives, specificity measures the model's success in identifying non-anomalies, complementing precision in evaluating our system's effectiveness. The formula for calculating specificity is given by  
\[\text{Specificity}=\frac{TN}{TN+FP}\]  
The calculated specificity and precision across different scenarios highlight our model's ability to effectively reduce false alarms. Remarkably, we achieved a specificity of 99.9% across all events, with the Slammer event achieving a perfect specificity of 100%.