Comprehensive Performance Evaluation of Association Rule Mining Algorithms for Border Gateway Protocol Anomaly Detection

Association rule mining is a data mining technique that concentrates on uncovering noteworthy connections or associations within a vast database of items. The process entails identifying frequently occurring sets of items and deriving association rules from those sets. Border Gateway Protocol (BGP) serves as the prevalent gateway protocol facilitating communication between autonomous systems, enabling the exchange of routing and reachability information. The occurrence of anomalous behavior in protocol attributes can be attributed to diverse factors such as insufficient provisioning, malicious attacks, traffic or equipment problems, and errors made by network operators. Based on the association rule, the dataset is examined and partitioned into sub-frequent pattern datasets. Each pattern dataset selects a single anomalous frequent itemset for comparison to determine the itemset with the highest anomaly value. The commonly used rule-based machine learning algorithms for anomaly detection include Frequent Pattern (FP) growth and Apriori algorithms. This study aims to use unsupervised algorithms based on association rules in select features to detect BGP anomalies. Additionally, the performance of these algorithms will be evaluated in terms of support, confidence, and accuracy values. Furthermore, the anomaly detection results were presented using a tailored and efficient tool and framework, enhancing the clarity and providing a more precise and detailed understanding of the performance.