# Median Absolute Deviation for BGP Anomaly Detection
## 4 Discussion  
Our method's performance across various cyber anomaly events achieved an overall accuracy of 90% and a precision of 95%, demonstrating a balance between accurately identifying true anomalies while minimizing false alarms. For the comparative analysis against deep learning models, our statistical approach demonstrate a strong and competitive performance surpassing three out of four models assessed. Despite the fact that MAD-MulW showcases high accuracy and precision in anomaly detection for most cases, our statistical \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Anomaly Event** & **RNN (\%)** & **MTAD (\%)** & **DAGMM (\%)** & **MAD-MulW (\%)** & **MAD (\%)** \\ \hline  & _Acc./Pre._ & _Acc./Pre._ & _Acc./Pre._ & _Acc./Pre._ & _Acc./Pre._ \\ \hline CodeRed 1 v2 Worm & 85.2/51.6 & 88.9/66.1 & 94.9/65.5 & 97.8/96.5 & 95.04/94.9 \\ Nimda Worm & 65.7/58.7 & 69.7/66.2 & 67.4/69.4 & 86.7/86.2 & 80.07/97.8 \\ Slammer Worm & 83.06/65.5 & 83.6/69.5 & 83.1/38.2 & 98.1/98.1 & 88.5/100 \\ Moscow Blackout & 91.9/60.7 & 98.2/80.9 & 97.9/53.8 & 99.3/99.6 & 96.1/87.8 \\ TMnet Misconfiguration & 91.7/60.4 & 97.1/70.7 & 96.9/45.4 & 99.2/99.6 & 96.1/95.9 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of anomaly detection performance: MAD vs. deep learning models. approach is particularly effective in the detection of the Slammer Worm and Nimda Worm events, highlighting its capacity to avoid false positives effectively. This precision reflects the method's effectiveness, yet the variability in accuracy across different scenarios points towards the influence of fundamental factors on these outcomes. A significant factor behind the observed variations is our uniform approach in setting the median absolute deviation (MAD) parameters across all anomaly events. These parameters were kept consistent to explore the wide array of anomaly types that MAD is capable of detecting, allowing for straightforward comparisons of the method's effectiveness across the diverse anomaly events. Additionally, it lays a strong foundation for presenting our technique to the research community by ensuring that our evaluation method remains consistent. However, it is understood that each event possesses distinct characteristics, and their influence on network behavior can differ significantly. For instance, a cyberattack that encrypts data on infected systems, effectively paralyzes these systems without necessarily generating additional network traffic. This behavior significantly differs with cyber threats where infected nodes initiate continuous DDoS attacks, generating significant traffic volumes as they spread across the network creating clear and detectable BGP anomalies. Adjusting these parameters--either through an auto-adjustable threshold (refer to the 'Future Work' section) or by setting specific parameters for each category to align with the distinct characteristics of each cyber anomaly--could significantly improve the method's overall effectiveness, enhancing the balance between precision and accuracy, which is crucial for maintaining the method's relevance in cybersecurity. Another important consideration is our reliance on literature-based timing to identify anomaly events, while this approach is helpful, it poses challenges for accurately assessing performance. The assumption that anomalies occur uniformly throughout 'green' periods and that 'normal' periods are entirely free of anomalies does not fully capture the sporadic nature of some anomalies. Not every instance within a green-highlighted period may be truly anomalous, nor may every 'normal' period be free of anomalies. It is entirely possible that all anomalies detected by MAD accurately represent anomalous behavior, and all identified normal data points are genuinely normal. This realization suggests MAD's performance may be more accurate than it appears, especially when considering the variable nature of anomaly occurrences.