Tailored ensemble anomaly detection for Internet disruptions

Abstract

The foundational role of the Internet necessitates robust methods for detecting and understanding disruptions. While machine learning offers a promising avenue for anomaly detection in heterogeneous, high-dimensional Internet measurement datasets, it faces significant challenges, including handling diverse disruption patterns, ensuring consistent performance across use cases, a scarcity of labeled ground truth, and difficulty explaining the black-box models. This paper proposes and thoroughly evaluates an ensemble anomaly detection approach for Internet disruption detection that addresses these limitations. This approach leverages multiple univariate unsupervised base detectors, each tailored to specific data sources, and combines their outputs through simple, intuitive aggregation mechanisms. An evaluation framework extensively assesses the proposed approach against alternative machine learning methods, demonstrating that the proposed ensemble detector achieves competitive and robust performance against other multivariate approaches, while crucially offering inherent explainability and significantly reducing the burden of parameter tuning. These findings highlight the practical efficacy of explainable, robust ensemble methods for Internet infrastructure monitoring.