Internet disruption detection

1. A method of identifying and reporting network anomalies, comprising:

receiving a plurality of routing path messages of advertised routes in a network, the routing path messages indicative of available network paths between network entities;

identifying an anomaly in an available network path indicative of a change to an advertised route, the anomaly causing network traffic between autonomous systems (AS) to follow a different path;

aggregating the plurality of routing path messages defining an anomaly received during a plurality of time intervals;

comparing the anomalies in each time interval of the plurality of time intervals to the anomaly in the others of the plurality of time intervals by:

building a node structure defining an isolation forest representative of the paths depicted in the routing path messages;

traversing the node structure; and

concluding, based on the comparison, whether a difference in the anomalies is indicative of a network disruption by:

defining a plurality of decision trees based on routing paths indicative of a sequence of autonomous systems for satisfying a plurality of routes to a destination;

splitting the decision trees until each respective decision tree has a terminal leaf node; and

identifying, based on an average number of splits until a terminal leaf node is attained, whether the decision tree is indicative of an anomaly.

2. The method of claim 1 further comprising:

determining a deviation in a traversed node structure corresponding to a first time interval of the plurality of time intervals from a traversed node structure corresponding to a second time interval; and

concluding the status of the network disruption based on a distance traversed in the traversed node structures until the deviation in the traversed node structures of the first and second time intervals.

3. The method of claim 1 further comprising:

identifying a subset of routing path messages pertaining to an internet entity;

aggregating the plurality of routing path messages corresponding to the identified subset;

comparing the anomalies for the aggregated routing path messages; and

reporting, based on the comparison, whether a network disruption exists within the internet entity based on the identified subset.

4. The method of claim 3 wherein each subset is directed to an internet entity, further comprising:

identifying routing path messages as pertaining to one of the internet entities; and

for each internet entity, maintaining a table of corresponding routing path messages.

5. The method of claim 1 further comprising:

aggregating a set of historical routing path messages indicative of previous anomalies;

aggregating a set of current routing path messages indicative of current anomalies,

the set of current and historical routing path messages aggregated based on a time of receipt of the plurality of routing path messages, the historical routing path messages having an earlier time of receipt than the current routing path messages; and

comparing anomalies based on the set of current routing path messages to the anomalies based on the set of historical routing path messages for determining an increase in the anomalies in the set of current routing path messages.

6. The method of claim 1 wherein:

the routing path messages include Border Gateway Protocol (BGP) messages indicative of paths between a plurality of autonomous systems (AS), and Classless Inter-Domain Routing (CIDR) messages indicative of ranges of internet addresses sharing a routing path, further comprising at least one of:

determining an anomaly from a change in an availability of a path to a destination AS of the plurality of autonomous systems; and

determining an anomaly from a change in a range of internet addresses reachable by routing through a transit AS of the plurality of autonomous systems.

7. The method of claim 2 further comprising:

identifying a time of each routing path message of the plurality of routing path messages;

arranging the routing path messages into a sequence of bins defined by a timing interval based on the respective time of each routing path message;

designating the bin corresponding to the most recently received routing path messages as current data and the remaining bins as historical data;

identifying a disruption based on a deviation of the current data in the current bin with a sequence of the bins designated as historical data.

8. The method of claim 2 further comprising:

building the node structure based on a plurality of features from the routing path messages;

arranging the node structure based on similarities in the features from the routing path messages;

determining a disruption based on a detection of outliers in the features of routing path messages corresponding to a current time interval.

9. The method of claim 2 further comprising:

geolocating the routing path messages based on a location of Autonomous System Numbers (ASNs) referenced in the routing path messages;

identifying, based on the geolocating, an internet entity affected by anomalies indicated by the routing path messages; and

rendering an indication of the network disruption affecting the identified internet entity.

10. The method of claim 9 wherein the affected internet entity is a geographical region.

11. The method of claim 4 further comprising:

receiving a user request for network disruptions affecting a queried internet entity, the user request indicative of a geographic region;

determining, based on the table of routing path messages corresponding to the queried internet entity in the user request, whether a network disruption exists for the queried internet entity.

12. The method of claim 5 further comprising:

concluding that a disruption exists based on an increase of at least 20% in anomalies in a ten minute period over anomalies in an immediately preceding 3 hour period.

13. The method of claim 1 wherein receiving the routing path messages further comprises receiving routing path messages derived from a network layer common to the other received routing path messages.

14. An internet outage detection server device, comprising:

an interface to a public access network configured to receive a plurality of routing path messages of advertised routes in a network, the routing path messages indicative of available network paths between network entities;

an analysis engine to identify an anomaly in an available network path indicative of a change to an advertised route, the anomaly causing network traffic between autonomous systems (AS) to follow a different path;

a gathering engine to aggregate the plurality of routing path messages defining an anomaly received during a plurality of time intervals;

analysis logic in the analysis engine to compare the anomalies in each time interval of the plurality of time intervals to the anomaly in the others of the plurality of time intervals, the analysis logic configured to:

build a node structure defining an isolation forest representative of the paths depicted in the routing path messages; and

traverse the node structure; and

a report generator to render an indication of, based on the comparison, whether a difference in the anomalies is indicative of a network disruption, the analysis logic further configured to evaluate the node structure for determining a similarity in routing paths by defining a plurality of decision trees based on routing paths indicative of a sequence of autonomous systems for satisfying a plurality of routes to a destination;

split the decision trees until each respective decision tree has a terminal leaf node; and

identify, based on an average number of splits until a terminal leaf node is attained, whether the decision tree is indicative on an anomaly.

15. The device of claim 14 further comprising:

a memory for storing a node structure representative of the paths depicted in the routing path messages;

the analysis logic further configured to traverse the node structure of a plurality of routing path messages, and to determine a deviation in a traversed node structure corresponding to a first time interval of the plurality of time intervals from a traversed node structure corresponding to a second time interval; and

the analysis logic configured to render the status of the network disruption based on a distance traversed in the traversed node structures until the deviation in the traversed node structures of the first and second time intervals.

16. The device of claim 14 wherein the analysis logic is further configured to:

identify a subset of routing path messages pertaining to an internet entity;

aggregating the plurality of routing path messages corresponding to the identified subset; and

compare the anomalies for the aggregated routing path messages, the report generator responsive to the analysis logic to report, based on the comparison, whether a network disruption exists within the internet entity based on the identified subset.

17. The device of claim 14 wherein the gathering engine is configured to:

aggregate a set of historical routing path messages indicative of previous anomalies;

aggregate a set of current routing path messages indicative of current anomalies, the set of current and historical routing path messages aggregated based on a time of receipt of the plurality of routing path messages, the historical routing path messages having an earlier time of receipt than the current routing path messages; wherein

the analysis logic is further configured to compare anomalies based on the set of current routing path messages to the anomalies based on the set of historical routing path messages for determining an increase in the anomalies in the set of current routing path messages.

18. The device of claim 14 wherein:

the routing path messages include Border Gateway Protocol (BGP) messages indicative of paths between a plurality of autonomous systems (AS), and Classless Inter-Domain Routing (CIDR) messages indicative of ranges of internet addresses sharing a routing path, the analysis logic further configured to

determine an anomaly from a change in an availability of a path to a destination AS of the plurality of autonomous systems; and

determine an anomaly from a change in a range of internet addresses reachable by routing through a transit AS of the plurality of autonomous systems.

19. A computer program embodying program code on a non-transitory medium that, when executed by a processor, performs steps for implementing a method for identifying and reporting network anomalies, the method comprising:

receiving a plurality of routing path messages indicative of a change to an advertised route, the routing path messages indicative of available network paths between network entities;

identifying an anomaly in an available network path indicative of a change to an advertised route, the anomaly causing network traffic between autonomous systems (AS) to follow a different path;

aggregating the plurality of routing path messages defining an anomaly received during a plurality of time intervals;

comparing the anomalies in each time interval of the plurality of time intervals to the anomaly in the others of the plurality of time intervals by:

building a node structure defining an isolation forest representative of the paths depicted in the routing path messages; and

traversing the node structure; and

concluding, based on the comparison, whether a difference in the anomalies is indicative of a network disruption by:

defining a plurality of decision trees based on routing paths indicative of a sequence of autonomous systems for satisfying a plurality of routes to a destination;

splitting the decision trees until each respective decision tree has a terminal leaf node; and

identifying, based on an average number of splits until a terminal leaf node is attained, whether the decision tree is indicative on an anomaly.