# Median Absolute Deviation for BGP Anomaly Detection
## 2 Materials and Methods
### Methodology
#### 2.1.3 Median Absolute Deviation (MAD)  
In our approach to anomaly detection, we employ the median absolute deviation (MAD). This statistical method was selected for its effectiveness in handling outliers and its high breakdown point compared to other statistical measures [28]. Unlike the standard \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Anomaly Event** & **Route Collector** & **Total** & **Extraction Dates (UTC)** \\ \hline Code Red 1 v2 & RRC04 & 1439 & 2001-07-18 19:06:00–2001-07-21 19:00:00 \\ Slammer & RRC04 & 960 & 2003-01-24 19:00:00–2003-01-26 18:57:00 \\ Nimda & RRC04 & 1738 & 2001-09-17 19:00:00–2001-09-21 09:51:00 \\ Moscow Blackout & RRC04 & 1440 & 2005-05-24 19:00:00–2005-05-27 18:57:00 \\ TMnet & RRC04 & 480 & 2015-06-12 00:00:00–2015-06-13 00:00:00 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Types of anomaly events detected, route collector, total count of observations per dataset, and specific dates of data extraction. Figure 1: Dataset overview: detailed preview of the first five entries from the CodeRed 1 v2 Dataset. deviation, which can be easily influenced by extreme values, MAD provides a more reliable measure of variability in datasets that may contain anomalies. By focusing on the median of absolute deviations from the dataset's median, MAD minimizes the impact of extreme values, ensuring that our anomaly detection approach is more resistant to skewed data [28]. Additionally, the simplicity of its calculation makes it an efficient choice for large datasets where computational efficiency is crucial. The formula for the MAD is given by  
\[\text{MAD}=\text{median}(|X_{i}-\text{median}(X)|)\]  
where \(X_{i}\) represents each individual data point and \(X\) the entire dataset. This formula calculates the median of the absolute deviations from the dataset's median, providing a measure that is less sensitive to extreme values [29]. Our Anomaly Definition: Having previously explained the concept of anomalies within the BGP context, we now detail our criteria for classifying behavior as anomalous. In our anomaly detection framework, an anomaly is identified when the overlap of announcements and withdrawals surpasses a predetermined threshold and persists for a specified duration. This threshold is established by multiplying the median absolute deviation (MAD) value by a factor \(n\). Given the inherently fluctuating nature of BGP, where variations between announcements and withdrawals are normal, we have incorporated an additional time constraint, denoted as \(t\). This constraint enhances the accuracy of our anomaly detection by filtering out truly significant anomalies from routine fluctuations. Specifically, the criterion for defining an anomaly within the BGP dataset, denoted as \(X\), is formulated as follows: Let \(M\) represent the median of \(X\) and MAD denote the median absolute deviation of \(X\). The threshold multiplier is represented by \(n\), and the minimum duration for a data point to be considered a significant anomaly is specified as \(t\) minutes. The anomaly detection criterion is defined by the formula  
\[|X_{i}-M|>n\times\text{MAD}\]  
where \(X_{i}\) is each individual data point in the dataset \(X\). This condition must be sustained for a period exceeding \(t\) minutes. In this formula, \(|X_{i}-M|\) calculates the absolute deviation of each data point from the median \(M\) of the dataset. A data point \(X_{i}\) is classified as an anomaly if its deviation from the median is greater than \(n\) times the MAD, and this deviation continues for more than \(t\) minutes. For instance, in this study, we adopted a threshold value of \(n=3\) and a time constraint of \(t=6\) min. Consequently, any data point in the dataset \(X\) is identified as an anomaly if it deviates from the median by more than three times the MAD value, and this significant deviation persists for a duration exceeding 6 min.