SHAP-BASED EVALUATION OF FEATURE IMPORTANCE IN BGP ANOMALY DETECTION MODELS

The classification of Border Gateway Protocol (BGP) anomalies is essential for maintaining Internet stability and security, as such anomalies can impair network functionality and reliability. Previous studies has examined the impact of key features on anomaly detection; however, current methodologies frequently demonstrate high computational costs, complexity, and usage challenges. The article presents a novel approach for evaluating feature importance based on SHAP (SHapley Additive Explanations), which provides a simplified, interpretable and efficient alternative specifically designed for LSTM-based classification models. A dedicated tool was developed to effectively evaluate feature impact, combining statistical analysis with visualizations to improve comprehension. This tool enables the assessment of global feature influence across datasets, emphasizing features that consistently increase classification performance. Furthermore, it offers insights into the impact of features on a per-class basis, demonstrating the varying contributions of individual features to the detection of different types of anomalies. Various datasets representing distinct anomaly types, such as direct, indirect, and outage anomalies, were utilized to validate the approach's applicability across a range of scenarios. This level of detail enables researchers to enhance LSTM models for particular anomaly categories while preserving overall efficacy. We suggested a structured algorithm to facilitate these developments, showing how feature impact evaluation can directly improve model optimization and detection tactics. Stability tests performed on various datasets demonstrate the reliability of feature rankings, thereby reinforcing the validity of the proposed methodology. The SHAP-based framework described in this paper makes complex analyses easier to understand while also providing useful insights. This approach enhances the efficiency of anomaly detection systems by allowing researchers to identify critical features, integrate new metrics, and refine existing LSTM models. The advancements enhance the security and resilience of infocommunication networks, effectively addressing emerging challenges in network security through a scalable and interpretable solution.