Discovering High-Impact Routing Events Using Traceroutes

With the increasing diffusion of Internet probing technologies, a large amount of regularly collected traceroutes are available for Internet Service Providers (ISPs) at low cost. We introduce a practically applicable methodology and algorithm that, given solely an arbitrary set of traceroutes, spot routing paths that change similarly over time, aggregate them into inferred events, and report each event along with the impacted observation points and a small set of IP addresses that can help identify its cause. The formal model at the basis of our methodology revolves around the notion of empathy, a relation that binds similarly behaving traceroutes. The correctness and completeness of our approach are based on structural properties that are easily expressed in terms of empathic measurements. We perform experiments with data from public measurement infrastructures like RIPE Atlas, showing the effectiveness of our algorithm in distilling events from a large amount of traceroute data. We also validate the accuracy of the inferred events against ground-truth knowledge of routing changes originating from induced and spontaneous routing events. Given these promising results, we believe our methodology can be an effective aid for ISPs to detect and track routing changes affecting many users (with potentially adverse effects on their connection quality).