Perceiving Internet Anomalies via CDN Replica Shifts

Anomalies are a ubiquitous and inevitable phenomenon associated with a complex and large-scale system such as the Internet. While measuring and analyzing network anomalies is as old as the Internet itself, comprehensively detecting anomalies at a global scale is a challenging task that requires a significant measurement infrastructure. In this paper, we demonstrate that the production Content Distribution Networks (CDNs), and their pervasive network infrastructure, could be effectively utilized to detect Internet anomalies. Our approach avoids direct network measurements and instead relies on “abnormal” spatial and temporal CDN replica shifts to indirectly sense anomalies. We measure replica shifts for five CDNs (Google, Amazon, Akamai, Fastly, and Incapsula) for two months. Contrary to our expectations, we find that (i) Google's and Amazon's CDNs, which are characterized by rich connectivity and infrastructure, are not best suited for our method because they effectively mask anomalies; (ii) Akamai is the most “sophisticated” of all evaluated CDNs, yet again not best suited to detect anomalies because it reacts exceptionally to much smaller network performance variations; (iii) Fastly's and Incapsula's replica shifts strongly correlate with network anomalies, making them viable anomaly predictors.