# Median Absolute Deviation for BGP Anomaly Detection
## 2 Materials and Methods
### Methodology
#### 2.1.3 Median Absolute Deviation (MAD)
This temporal criterion is essential for distinguishing between normal BGP traffic fluctuations and anomalous behavior, thereby minimizing false positives and effectively highlighting significant anomalies that demonstrate continuous and abnormal activity. The choice of \(n=3\) as the threshold multiplier and 6 min as the minimum duration \(t\) for anomaly classification in this study is based on a combination of statistical rationale and empirical observations of BGP behavior. Statistical Justification for the Threshold Multiplier (\(n=3\)): In statistical analysis, a common practice for identifying outliers is to consider values that lie more than three standard deviations from the mean. By analogy, setting \(n=3\) in the MAD-based approach aligns with this widely accepted statistical norm. The MAD, being a robust measure of variability, when multiplied by 3, effectively isolates extreme deviations that are unlikely to occur under normal circumstances. Empirical Basis for the Time Duration (\(t=6\) min): The selection of 6 min as the duration for sustaining an anomaly is derived from empirical observations of BGP traffic patterns. BGP updates, due to the protocol's nature, exhibit a certain degree of variability. Thesefluctuations are often short-term and do not necessarily indicate a significant problem. Our analysis of historical BGP data revealed that true anomalies usually maintain their presence for durations exceeding these brief fluctuations. A time frame of 6 min was identified as an effective threshold to distinguish between these short-term fluctuations and more prolonged, unusual patterns. Consequently, this 6-min criterion serves as a practical filter to reduce false positives, ensuring that only those deviations that demonstrate persistent abnormal behavior are flagged as anomalies. To ensure consistent analysis of MAD's effectiveness across diverse BGP events, we have decided to maintain constant parameters throughout our evaluations. However, adjusting these parameters could significantly enhance anomaly detection for specific scenarios, considering MAD's reliance on traffic fluctuations and BGP data variability. Future research will focus on developing an adaptive dynamic threshold mechanism, capable of self adjusting in response to changes in data variability. Further details can be found in Section 5.1. Figure 2 provides a detailed flowchart for this methodology. The first step in our anomaly detection process begins with the extraction of data, either directly from a data collector, in our case, we used the RIPE NCC [24], or from an existing dataset. During the preprocessing phase, we organize this data into 3-min batches and compute the number of record counts, announcements, and withdrawals for each batch. Once the dataset is prepared, we compute the median absolute deviation (MAD) and establish the values for each parameter of our model: the factor \(n\) and the time duration \(t\). Following this setup, our system examines the data, specifically identifying instances where the overlap of announcements and withdrawals exceeds the defined threshold for the required minimum duration. This process identifies potential anomalies. Subsequently, the output is categorized into two segments: anomalous BGp traffic or normal BGP traffic; this output can be combined with an AI-based model to improve the accuracy of the detection of BGP anomalies. The final step involves a thorough analysis of these results to evaluate the method's performance, ensuring that our system can effectively differentiate between normal and anomalous BGP traffic. This differentiation is crucial for maintaining network integrity and optimizing performance.