Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
Center for Applied Internet Data Analysis
www.caida.org > publications : papers : 2019 : chocolatine
Chocolatine: Outage Detection for Internet Background Radiation
A. Guillot, R. Fontugne, P. Winter, P. Mérindol, A. King, A. Dainotti, and C. Pelsser, "Chocolatine: Outage Detection for Internet Background Radiation", in Network Traffic Measurement and Analysis Conference (TMA), Jun 2019.
|   View full paper:    PDF    arXiv    |  Citation:    BibTeX   |

Chocolatine: Outage Detection for Internet Background Radiation

Andreas Guillot2
Romain Fontugne3
Philipp Winter1
Pascal Mérindol2
Alistair King1
Alberto Dainotti1
Cristel Pelsser2
1

CAIDA, San Diego Supercomputer Center, University of California San Diego

2

ICube, University of Strasbourg

3

IIJ Research Lab

The Internet is a complex ecosystem composed of thousands of Autonomous Systems (ASs) operated by independent organizations; each AS having a very limited view outside its own network. These complexities and limitations impede network operators to finely pinpoint the causes of service degradation or disruption when the problem lies outside of their network. In this paper, we present Chocolatine, a solution to detect remote connectivity loss using Internet Background Radiation (IBR) through a simple and efficient method. IBR is unidirectional unsolicited Internet traffic, which is easily observed by monitoring unused address space. IBR features two remarkable properties: it is originated worldwide, across diverse ASs, and it is incessant. We show that the number of IP addresses observed from an AS or a geographical area follows a periodic pattern. Then, using Seasonal ARIMA to statistically model IBR data, we predict the number of IPs for the next time window. Significant deviations from these predictions indicate an outage. We evaluated Chocolatine using data from the UCSD Network Telescope, operated by CAIDA, with a set of documented outages. Our experiments show that the proposed methodology achieves a good trade-off between true-positive rate (90%) and false- positive rate (2%) and largely outperforms CAIDA’s own IBR based detection method. Furthermore, performing a comparison against other methods, i.e., with BGP monitoring and active probing, we observe that Chocolatine shares a large common set of outages with them in addition to many specific outages that would otherwise go undetected.

Keywords: internet outages, network telescope, passive data analysis, security
  Last Modified: Tue Oct-8-2019 11:21:04 PDT
  Page URL: http://www.caida.org/publications/papers/2019/chocolatine/index.xml