Internet disruption detection

An internet outage detection server device, comprising:

• an interface to a public access network configured to receive a plurality of routing path messages of advertised routes in a network, the routing path messages indicative of available network paths between network entities;
• an analysis engine to identify an anomaly in an available network path indicative of a change to an advertised route, the anomaly causing network traffic between autonomous systems (AS) to follow a different path;
• a gathering engine to aggregate the plurality of routing path messages defining an anomaly received during a plurality of time intervals;
• analysis logic in the analysis engine to compare the anomalies in each time interval of the plurality of time intervals to the anomaly in the others of the plurality of time intervals, the analysis logic configured to:
• build a node structure defining an isolation forest representative of the paths depicted in the routing path messages;
• and
• traverse the node structure;
• and
• a report generator to render an indication of, based on the comparison, whether a difference in the anomalies is indicative of a network disruption, the analysis logic further configured to evaluate the node structure for determining a similarity in routing paths by defining a plurality of decision trees based on routing paths indicative of a sequence of autonomous systems for satisfying a plurality of routes to a destination;
• split the decision trees until each respective decision tree has a terminal leaf node;
• and
• identify, based on an average number of splits until a terminal leaf node is attained, whether the decision tree is indicative on an anomaly.

A computer program embodying program code on a non-transitory medium that, when executed by a processor, performs steps for implementing a method for identifying and reporting network anomalies, the method comprising:

• receiving a plurality of routing path messages indicative of a change to an advertised route, the routing path messages indicative of available network paths between network entities;
• identifying an anomaly in an available network path indicative of a change to an advertised route, the anomaly causing network traffic between autonomous systems (AS) to follow a different path;
• aggregating the plurality of routing path messages defining an anomaly received during a plurality of time intervals;
• comparing the anomalies in each time interval of the plurality of time intervals to the anomaly in the others of the plurality of time intervals by:
• building a node structure defining an isolation forest representative of the paths depicted in the routing path messages;
• and
• traversing the node structure;
• and
• concluding, based on the comparison, whether a difference in the anomalies is indicative of a network disruption by:
• defining a plurality of decision trees based on routing paths indicative of a sequence of autonomous systems for satisfying a plurality of routes to a destination;
• splitting the decision trees until each respective decision tree has a terminal leaf node;
• and
• identifying, based on an average number of splits until a terminal leaf node is attained, whether the decision tree is indicative on an anomaly.