# Median Absolute Deviation for BGP Anomaly Detection
## 1 Introduction
### Theoretical Framework  
This section outlines the essential concepts of the Border Gateway Protocol (BGP), which form the foundation of our research and enable a comprehensive understanding of its mechanisms and implications in cybersecurity. The Internet is segmented into numerous distinct regions of administrative authority, often referred to as Autonomous Systems (ASs) [18]. Each Autonomous System (AS) comprises a collection of routers managed by a single administrative domain, and is uniquely identified by an AS number [19]. These identifiers are allocated from either public or private ranges, ensuring unique identification across the internet [20]. The principal routing protocol for exchanging Network Routing Information (NRI) among these Autonomous Systems (ASes) is BGP. It operates over the Transmission Control Protocol (TCP), specifically utilizing TCP port number 179 [2]. Incorporating TCP as the underlying transport protocol is essential for BGP operations, as it eliminates the need for BGP to autonomously manage the complexities of message delivery and flow control among peers. This setup enables a BGP router to establish direct TCP connections with routers in distinct ASs. Due to the extensive nature of BGP routing tables, these are shared just once upon the initial establishment of the connection between peering routers. Only updates, such as the introduction of new prefixes or the withdrawal of existing ones, are communicated thereafter [7]. This strategic use of TCP not only simplifies the operational mechanics of BGP but also significantly improves its efficiency and the reliability of inter-AS connections. BGP utilizes a series of message types, each with a specific purpose, to communicate between peers: these include OPEN, UPDATE, NOTIFICATION, and KEEPALIVE messages. * OPEN Message: This is the first message sent after establishing a TCP connection between two BGP peers. It is used to initiate the BGP session and includes critical information such as the AS number and the BGP version. * KEEPALIVE Message: Sent periodically to sustain the connection, these messages confirm the active status of the link between BGP peers. * NOTIFICATION Message: Used to indicate errors or terminate a BGP session, detailing the reasons for session closure or errors encountered. * UPDATE Message: Perhaps the most significant, these messages perform three key functions: announcing new routes, withdrawing previously advertised routes, and modifying existing routes with updated parameters. Additionally, UPDATE messages can adjust route attributes to adapt to changing network conditions or policies. Given the focus of this research on update messages, a detailed examination of route advertisements and withdrawals is pertinent. Route Advertisements: In BGP operations, when a router identifies a preferable route due to changes in network topology or policy decisions, it communicates this update to its peers through a route advertisement within an UPDATE message [9]. These messages contain important information, including the network destination (IP prefix) and the AS-PATH. The primary objective of these advertisements is to ensure that all peer routers are informed of the most current and efficient routing paths, thereby maintaining the overall efficiency and stability of internet routing. Route Withdrawals: Equally significant are route withdrawals, which play a critical role in upholding the accuracy and efficiency of BGP routing tables. If a previously valid route becomes obsolete or less desirable, perhaps due to changes in network topology, policy alterations, or as a consequence of cyber attacks, routers forward this change to their peers through a route withdrawal message. Such messages specify the IP prefixes that are no longer accessible, leading peer routers to remove these routes from their routing tables [1]. This process is essential for ensuring that internet traffic is not routed through invalid or inefficient paths, thereby safeguarding the integrity and efficiency of network routing.