Internet Control Plane Event Identification using Model Based Change Point Detection Techniques

TL;DR

This paper introduces a model-based change point detection method to identify control plane events in Internet routing, focusing on global and Indian AS topology, using statistical analysis of routing features.

Contribution

It proposes a novel counting-based measure and applies change point detection algorithms to identify and analyze control plane events from routing data.

Findings

Successfully detected the SEA-Me-We4 cable cut events in 2012.

Quantified the impact and duration of control plane events.

Validated the approach on real-world routing incidents.

Abstract

In the raise of many global organizations deploying their data centers and content services in India, the prefix reachability performance study from global destinations garners our attention. The events such as failures and attacks occurring in the Internet topology have impact on Autonomous System (AS) paths announced in the control plane and reachability of prefixes from spatially distributed ASes. As a consequence the customer reachability to the services in terms of increased latency and outages for a short or long time are experienced. The challenge in control plane event detection is when the data plane traffic is able to reach the intended destinations correctly. However detection of such events are crucial for the operations of content and data center industries. By monitoring the spatially distributed routing table features like AS path length distributions, spatial prefix reachability distribution and covering to overlap route ratio, we can detect the control plane events. In our work, we study prefix AS paths from the publicly available route-view data and analyze the global reachability as well as reachability to Indian AS topology. To capture the spatial events in a single temporal pattern, we propose a counting based measure using prefixes announced by x % of spatial peers. Employing statistical characteristics change point detection and temporal aberration algorithm on the time series of the proposed measure, we identify the occurrence of long and stochastic control plane events. The impact and duration of the events are also quantified. We validate the mechanisms over the proposed measure using the SEA-Me-We4 cable cut event manifestations in the control plane of Indian AS topology. The cable cut events occurred on 6th June 2012 (long term event) and 17th April 2012 (stochastic event) are considered for validation.