Inferring the Origin of Routing Changes Based on Preferred Path Changes

Previous studies on inferring the origin of routing changes in the Internet are limited to failure events that generate a large number of routing changes. In this paper, we present a novel approach to origin inference of small failure events. Our scheme focuses on routing changes imposed on preferred paths of prefixes and not on transient paths triggered by path exploration. We first infer the preferred path of each prefix and measure the stability of each inter-AS link over this preferred path. The stability is measured based on routing changes of specific prefixes that regularly use the link and are advertised by the AS adjacent to the link. We then correlate the stability of other links over this path and infer the instability boundary as the origin. Our analysis using Oregon RouteViews data and trouble tickets from operational networks shows that our inference scheme can identify the origins of small failure events with very high accuracy.