# Median Absolute Deviation for BGP Anomaly Detection
## 1 Introduction
### Related Work  
The field of BGP anomaly detection is marked by an extensive exploration of methodologies aimed at enhancing the stability and security of the global Internet infrastructure. This spectrum ranges from statistical techniques to the application of advanced machine learning (ML) models and Deep Learning (DL) models, among others; each contributing to the ongoing fight against cyber threats. [PERSON] et al. [14] introduced a statistical method utilizing an updated visibility matrix to effectively identify significant BGP disruptions. This approach used a heuristic algorithm to find a denser and larger submatrix from the original indicating unusual activity. Even though it demonstrated practical relevance, its dependency on heuristic algorithms implies computational complexity that could escalate with the size of the data and require significant computational resources. Additionally, [PERSON] et al. [15] introduced the Generalized Likelihood Ratio Test (GLRT) for anomaly detection, analyzing data from a single BGP router. Their focus on BGP update features such as AS path length and edit distance provided valuable insights into the behavior of the internet under stress. However, the detection time, often within an hour, presents limitations for real-time responses, thereby highlighting the imperative for methods that enable more immediate detection. Simultaneously, [PERSON] et al. [16] concentrated on identifying Autonomous Systems (ASes) susceptible to malicious IP block hijacking, creating a classifier for pinpointing similar ASes. Their research highlighted the critical role of intermittent AS presence and fluctuating prefix origination behavior as key classification features. Furthermore, [PERSON] et al. [17] presented a method for detecting BGP routing anomalies by analyzing burstiness in announcements updates. Their method's effectiveness relies on discerning patterns of frequent announcements followed by periods of inactivity, which are indicative of potential disruption, and while their method showed effectiveness in identifying anomalous patterns, it found difficulties with differentiating between benign and malicious bursts, in addition to its dependency on manually verified truth metadata introducing uncertainties about its real-world applicability. [PERSON] et al. [9] employed Recurrent Neural Networks (RNNs), specifically Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models, to detect BGP anomalies. They compared LSTM and GRU performance towards different anomalous events, highlighting deep learning's potential for anomaly detection. However, the complex nature of deep learning models requiring extensive parameter tuning and relying on accurately labeled datasets, presents challenges for real-world applications due to computational demands and sensitivity to missing data. Moreover, the MAD-MulW framework by [PERSON] et al. [8] presents an advancement in unsupervised anomaly detection within BGP security events through its multi-window serial framework, integrating W-GAT and W-LAT modules for adaptive sample weighting and predictive reconstruction. The approach's efficiency is evident by its average accuracy score of over 96%. In addition, it demonstrates a higher performance than classical and recent unsupervised models. Despiteits effectiveness, the model faces challenges with determining optimal window sizes for varied datasets and managing increased model space and time resources due to sample expansion. Finally, [PERSON] et al. [2020] proposed a Support Vector Machine-based BGP anomaly detection method (SVM-BGPAD), employing feature selection algorithms and optimization techniques. Despite its promising results, the method's reliance on complex feature selection and parameter optimization processes presents challenges for practical deployment, requiring computational resources and machine learning expertise.