# Median Absolute Deviation for BGP Anomaly Detection
## 1 Introduction  
In today's interconnected world, the internet has emerged as the keystone of contemporary communication and information exchange, serving as the backbone for various sectors such as commerce, education, healthcare, and social interaction. Because of society's increasing reliance on the internet, the need for robust and secure internet infrastructure becomes indispensable. This scenario underscores the importance of the Border Gateway Protocol (BGP), the principal inter-domain routing protocol [1]. The BGP is a path vector protocol that meticulously manages Network Reachability Information (NRI) between Autonomous Systems (ASes). Its primary function is to ensure the delivery of stable and secure routing paths, while preventing routing loops [2]. The optimal functioning of BGP is crucial for the seamless exchange of the information underlying the stability and security of the entire internet infrastructure. However, the inherent complexity of BGP, coupled with its need to adapt to varied network environments, renders it susceptible to a spectrum of anomalies. These include Denial of Service (DoS) attacks, routing hijackings, and misconfigurations [1]. The potential severity of these anomalies is illustrated by [PERSON] et al. [3] which reveals that approximately 20% of hijackings and misconfigurations have the potential to disrupt 90% of internet traffic in less than two minutes, even though they typically last less than 10 min. In recent years, most of the approaches towards addressing this escalating problem are based on machine learning (ML) [4; 5; 6; 7] and deep learning (DL) techniques [8; 9; 10], and while these methods are effective in identifying the unusual patterns indicative of cyber threats, their implementation requires extensive data preprocessing and accurate data labeling to differentiate between normal and anomalous behaviors effectively. In addition, these techniques require time and resource-intensive training stages. Moreover, there is acontinuous need to update and retrain these models to recognize new, unseen anomalies. These data preprocessing and updating requirements becomes even more apparent as recent statistics indicate that these attacks have not only doubled in size over the past two years [11] but also have become increasingly sophisticated [12]. This critical requirement for continuous improvement is the primary motivator for our research into developing a novel detection methodology. Our approach aims to be both adaptable and efficient, particularly suited to address the dynamic nature of cyber threats targeting the Border Gateway Protocol (BGP). The novelty of our method lies in its reliance on statistical techniques, alleviating the complexities and resource demands typically required by machine learning and deep learning models. Our approach has the ability of adapting swiftly to new threats while minimizing the need for extensive data preprocessing and training, making it suitable for proactive threat detection. This research focuses on the early detection of anomalies linked to major cyber incidents. These include worm attacks like Code Red 1 v2, Slammer, and Nimda, the Moscow blackout due to a link failure, and the misconfiguration incident at Telekom Malaysia. Such cyber threats have historically posed significant challenges to the stability of the internet, highlighting the need for thorough investigation and the development of efficient detection mechanisms. Our study aims to add value to this field by enhancing the understanding and detection of these cyber threats. The research incorporates the median absolute deviation (MAD), a solid statistical technique, for the analysis of anomalies within BGP update messages. Renowned for its robustness against outliers [13], the MAD measure is also noted for its technical precision and operational simplicity. These attributes make it exceptionally suitable for detecting anomalies at early stages.