Quantifying Differences Between Batch and Streaming Detection of Internet Outages

Stutz, Erica and Heidemann, John and Pradkin, Yuri

citation

Erica Stutz, John Heidemann and Yuri Pradkin 2025. Quantifying Differences Between Batch and Streaming Detection of Internet Outages. Proceedings of the IFIP International Workshop on Traffic Monitoring and Analysis (Copenhagen, Denmark, Jun. 2025), to appear. [PDF]

abstract

A number of different systems today detect outages in the IPv4 Internet, often using active probing and algorithms based on Trinocular’s Bayesian inference. Outage detection methods have evolved, both to provide results in near-real-time, and adding algorithms to account for important but less common cases that might otherwise be misinterpreted. We compare two implementations of active outage detection to see how choices to optimize for near-real-time results with streaming compare to designs that use long-term information to maximize accuracy using batch processing. Examining 8 days of data, starting on 2021-02-26, we show that the two similar systems agree most of the time, more than 84%. We show that only 0.2% of the time the algorithms disagree, and 15% of the time only one reports. We show these differences occur due to streaming’s requirement for rapid decisions, precluding algorithms that consider long-term data (days or weeks). These results are important to understand the trade-offs that occur when balancing timely results with accuracy. Beyond the two systems we compare, our results suggest the role that algorithmic differences can have in similar but different systems, such as the several implementations of Trinocular-like active probing today.

reference

@inproceedings{Stutz25a,
  author = {Stutz, Erica and Heidemann, John and Pradkin, Yuri},
  title = {Quantifying Differences Between Batch and Streaming Detection of {Internet} Outages},
  booktitle = {Proceedings of the  IFIP International Workshop on Traffic Monitoring and Analysis},
  year = {2025},
  sortdate = {2025-06-12},
  project = {ant, eieio, reu, isireu},
  jsubject = {topology_modeling},
  pages = {to appear},
  month = jun,
  address = {Copenhagen, Denmark},
  publisher = {IFIP},
  jlocation = {johnh: pafile},
  keywords = {trinocular, streaming, batch, comparision, validation},
  url = {https://ant.isi.edu/%7ejohnh/PAPERS/Stutz25a.html},
  pdfurl = {https://ant.isi.edu/%7ejohnh/PAPERS/Stutz25a.pdf},
  blogurl = {https://ant.isi.edu/blog/?p=tbd}
}