Less is More: Optimizing Probe Selection Using Shared Latency Anomalies

TL;DR

This paper presents a topology-agnostic method for detecting shared latency anomalies in residential Internet, enabling efficient probe selection that captures most anomalies with fewer measurements, thus improving scalability and cost-efficiency.

Contribution

The authors develop a novel sampling algorithm that leverages shared anomaly characteristics to reduce probe redundancy while maintaining high anomaly detection coverage.

Findings

Shared anomalies often have similar amplitude within the same ISP.

The sampling algorithm captures 95% of anomaly impact with less than half the probes.

Geographic diversity remains important for probe selection within ISPs.

Abstract

Latency anomalies, defined as persistent or transient increases in round-trip time (RTT), are common in residential Internet performance. When multiple users observe anomalies to the same destination, this may reflect shared infrastructure, routing behavior, or congestion. Inferring such shared behavior is challenging because anomaly magnitudes vary widely across devices, even within the same ISP and geographic area, and detailed network topology information is often unavailable. We study whether devices experiencing a shared latency anomaly observe similar changes in RTT magnitude using a topology-agnostic approach. Using four months of high-frequency RTT measurements from 99 residential probes in Chicago, we detect shared anomalies and analyze their consistency in amplitude and duration without relying on traceroutes or explicit path information. Building on prior change-point detection techniques, we find that many shared anomalies exhibit similar amplitude across users, particularly within the same ISP. Motivated by this observation, we design a sampling algorithm that reduces redundancy by selecting representative devices under user-defined constraints. Our approach captures 95 percent of aggregate anomaly impact using fewer than half of the deployed probes. Compared to two baselines, it identifies significantly more unique anomalies at comparable coverage levels. We further show that geographic diversity remains important when selecting probes within a single ISP, even at city scale. Overall, our results demonstrate that anomaly amplitude and duration provide effective topology-independent signals for scalable monitoring, troubleshooting, and cost-efficient sampling in residential Internet measurement.