# Median Absolute Deviation for BGP Anomaly Detection
## 5 Conclusions and Future Work
### Future Work  
Building upon the foundations laid by this study, we identify several key areas for future research that promise to further refine and expand the scope of BGP anomaly detection:  
Diversification of Data Sources: Incorporating BGP data from a wider array of sources, including different geographic regions and network environments, will enhance the robustness and applicability of the MAD methodology. This diversification will allow for a more comprehensive understanding of global BGP dynamics and anomaly patterns.  
Automation through a dynamic threshold: An important aspect of our ongoing research is the development of an algorithm that dynamically calculates the factor \(n\) which, when multiplied by MAD, determines the anomaly detection threshold. This innovation seeks to replace the static assumption that a factor of 3 is universally applicable, with a more adaptive threshold that better reflects the specific variability of the data.  
Exploration of Real-Time Detection Capabilities: While real-time anomaly detection capabilities have not yet been tested with our methodology, we recognize it as a crucial area for future research. Given the lower computational demands of the MAD method, we strongly encourage further exploration in this direction. Adapting MAD for real-time data processing could potentially enable the immediate identification and mitigation of emerging threats. The efficiency of MAD presents a promising foundation for developingreal-time anomaly detection systems that are both scalable and adaptable to the dynamic nature of network traffic and threats. In the medium to long term, once we have a Quic implementation, we consider testing MAD over Quic to assess its performance and compare it to current implementations since MAD will not be affected by using BGP over Quic [33].  
Integrating MAD with ML/DL for Enhanced Detection and Prediction: Integrating median absolute deviation (MAD) with machine learning (ML) or deep learning (DL) models represents a promising frontier for future research. This synergy allows for the training of ML/DL models with MAD-processed data, enabling the identification of anomalies through traffic pattern analysis while maintaining the capability for independent detection by either method. This ensures comprehensive coverage, where MAD can catch anomalies that ML/DL models might miss, and vice versa, bolstering the network's defense mechanism with both predictive and reactive capabilities.  
Conceptualization, M.A.R.-C., J.A.C.-C., J.A.P.-D. and C.M.-C.; Methodology, M.A.R.-C.; Software, M.A.R.-C. and J.A.C.-C.; Validation, J.A.C.-C., J.A.P.-D. and C.M.-C.; Formal analysis, M.A.R.-C. and J.A.P.-D.; Investigation, M.A.R.-C.; Resources, C.M.-C.; Data curation, M.A.R.-C., J.A.C.-C., J.A.P.-D. and C.M.-C.; Writing--original draft, M.A.R.-C.; Writing--review & editing, M.A.R.-C., J.A.C.-C. and J.A.P.-D.; Visualization, M.A.R.-C.; Supervision, J.A.C.-C., J.A.P.-D. and C.M.-C.; Project administration, J.A.C.-C. and J.A.P.-D.; Funding acquisition, J. A.P.-D. All authors have read and agreed to the published version of the manuscript.  
This work was supported in part by the Fondo Regional para la Innovacion Digital en America Latina y el Caribe (FRIDA).  
The data presented in the study are openly available in the Routing Information Service (RIS) from the Reseaux IP Europeens Network Coordination Centre (RIPE NCC) at [[https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/](https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/)]([https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/](https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/)) (accessed on 19 April 2024 ).  
We acknowledge Tecnologico de Monterrey and LACNIC for their support in this research.  
The authors declare no conflicts of interest.