I-Seismograph: Observing, Measuring, and Analyzing Internet Earthquakes

Disruptive events, such as large-scale power outages, undersea cable cuts, or security attacks, could have an impact on the Internet and cause the Internet to deviate from its normal state of operation, which we also refer to as an “Internet earthquake.” As the Internet is a large, complex moving target, unfortunately little research has been done to define, observe, quantify, and analyze such impact on the Internet, whether it is during a past event period or in real time. In this paper, we devise an Internet seismograph, or I-seismograph, to fill this gap. Since routing is the most basic function of the Internet and the Border Gateway Protocol (BGP) is the de facto standard inter-domain routing protocol, we focus on BGP to observe, measure, and analyze the Internet earthquakes. After defining what an impact to BGP entails, we describe how I-seismograph observes and measures the impact, exemplify its usage during both old and recent disruptive events, and further validate its accuracy and convergency. Finally, we show that I-seismograph can further be used to help analyze what happened to BGP while BGP experienced an impact, including which autonomous systems (AS) were affected most or which AS paths or path segments surged significantly in BGP updates during an Internet earthquake.

I. Introduction

The Internet has become a critical infrastructure of our society, yet few studies have focused on not only how to monitor the Internet as a whole, but also how to quantify the impact that disruptive events (such as [1]–[7]) may have on it. Although events such as security attacks, large-scale power outages, hurricanes, undersea cable cuts, and other types of natural disasters may cause observable disturbances to the normal operation of the Internet, we know little about the kind of impact each event might cause and how big it might be. The lack of such knowledge also makes it difficult to conduct effective network diagnosis, recovery, or other operation tasks. In fact, there is not even an established criterion for observing different kinds of impacts or for quantifying what “big” or “small” means.