# Median Absolute Deviation for BGP Anomaly Detection
## 1 Introduction
The effectiveness of the MAD method in this context stems from its capability to correlate observed anomalies with the occurrence of significant cyber-attacks, a vital step in distinguishing between normal and anomalous traffic patterns. This differentiation, inherently challenging due to the complexity of network traffic, is essential for establishing a clear baseline definition of what constitutes an anomaly within cybersecurity. By setting this baseline, it becomes possible to identify network anomalies more clearly and improve our understanding of cyber threat patterns, ultimately leading to the development of more effective detection and mitigation strategies. Therefore, we believe that the work presented hereby represents a significant contribution to the field of cybersecurity by introducing an innovative proactive anomaly detection approach that utilizes the median absolute deviation (MAD) technique. A key advantage of this approach is the statistical foundation of the MAD method, which substantially lowers the need for extensive training on historical data compared to machine learning and deep learning approaches. This aspect is particularly valuable in the rapidly changing context of cyber threats, as it ensures the technique's effectiveness in combating new or previously unrecognized anomalies by focusing on data variability instead of relying on patterns from past data. This paper also provides a thorough evaluation and analysis of various anomalies variations, including indirect anomalies, direct unintended anomalies, and link failures; compared to other approaches like those by [PERSON] et al. [10] and [PERSON] et al. [5] which only detected indirect anomalies, our approach demonstrates a broad applicability in detecting a wide spectrum of network disruptions. Moreover, MAD can potentially complement machine learning (ML) and deep learning models in the cybersecurity field. By demonstrating the ability of MAD to identify a wide range of anomalies with minimal data preprocessing and its potential in detecting unseen attacks, the study suggests that incorporating MAD significantly enhances the accuracy and precision of ML-based cybersecurity measures. This proposal paves the way for developing more flexible and stronger defenses against the constantly changing threats in cyberspace. To summarize, this study makes the following contributions. 1. The design and introduction of a resource-efficient median absolute deviation (MAD) method for detecting network anomalies, which significantly lowers computational demands and that could work in tandem with machine learning and deep learning models. 2. The implementation of MAD's statistical approach to reduce reliance on extensive historical data, thereby enhancing the adaptability of cybersecurity systems to new threats. 3. The comprehensive analysis of various anomaly types with MAD, demonstrating its broad applicability and versatility in addressing a spectrum of network challenges. The structure of this paper is organized as follows: Section 2 delves into related work, offering both a background and context essential for this study. It then outlines the theoretical framework, emphasizing the specific attributes for our investigation, followed by an explanation of the dataset processing steps, detailing the preparation and management of data for analysis. Additionally, this section presents the methodology used, outlining the techniques and strategies utilized for detecting and analyzing anomalies. Section 3 presents the results of this research, followed by the performance evaluation and a comparative analysis against deep learning models. Section 4 engages in a discussion, and Section 5 concludes the paper and proposes future research directions.