# Median Absolute Deviation for BGP Anomaly Detection
## 3 Results  
This section presents the findings from our study on a novel approach to detecting anomalies in the Border Gateway Protocol (BGP), illustrated through a series of graphs. These charts incorporate a color-coding scheme designed to facilitate data interpretation: blue for BGP announcements, red for withdrawals, detected anomalies are highlighted in pink, and green to mark the actual times when cyber events occurred. Please note that when there is an overlap between occurrences and detected anomalies, the resulting color combination of pink and green may appear light brown. This indicates that the detected pink anomalies fall within the time range of occurrences, representing an accurate detection. The graphs are plotted with timestamps on the x-axis, showing continuous data within a specified time range (refer to Table 2 for exact extraction dates), and the y-axis representing the volume of announcements and withdrawals. Next, we provide a brief explanation on interpreting the model's performance, which will be foundational towards understanding the performance evaluation in terms of accuracy and precision metrics. * True Positives (TP): When the identified anomalies (highlighted in pink) coincide with the critical periods of each anomaly event (marked in green), visually this represent accurately detected anomalies. * False Positives (FP): These are the anomalies detected that do not overlap with the green regions, indicating inaccurately detected anomalies. * True Negatives (TN): Although not explicitly visualized, true negatives can be understood as the portions of the graph not highlighted (the \"white\" areas), representing normal events correctly identified as normal. * False Negatives (FN): These are events within the green regions not highlighted in pink, indicating missed anomalies. This visual representation facilitates a clear understanding of when detected anomalies correspond to actual cyber events, demonstrating our method's efficacy in responding to real-world incidents. This visual technique, combined with outputs specifying the detection period and its duration (as showcased in Figure 3), provides a clear basis for evaluating the effectiveness of our BGP anomaly detection technique. The outcomes of our graphical analysis for various anomalies are detailed as follows:  
Slammer Worm (Figure 4): The detection method accurately identified all anomalies coinciding with the peak activity of the Slammer worm, demonstrating effective anomaly detection during this specific event. TMnet Misconfiguration (Figure 5): A high level of effectiveness was also observed for TMnet misconfiguration. Visually, our method successfully identified the majority of anomalies, demonstrating reliable detection capabilities for direct unintended category. Figure 3: Sample data preview: first five rows of the TMnet detection output  
CodeRed 1 v2 Worm and Moscow Blackout (Figures 6 and 7): The analyses of these events further validate the model's effectiveness in identifying anomalies across the direct intended and link failure categories, highlighting the method's robustness and adaptability. Figure 4: Implementing MAD for anomaly detection over Slammer Worm Attack: visual representation of Announcements and Withdrawals volumes over time with anomalies marked in pink and high-activity occurrence periods in green. Figure 5: Implementing MAD for anomaly detection over Telekom Malaysia Misconfiguration: visual representation of Announcements and Withdrawals volumes over time with anomalies marked in pink and high-activity occurrence periods in green. Figure 6: Implementing MAD for anomaly detection over Code Red 1 v2 Attack: visual representation of Announcements and Withdrawals volumes over time with anomalies marked in pink and high-activity occurrence periods in green. Nimda (Figure 8): The visual analysis showcases that almost all the anomalies were detected within the occurrence period, showcasing our system's capability in real-world event detection.