A Survey of Network Outage Detection

doi:10.3969/j.issn.1006-2475.2025.07.007

Abstract

Abstract: Abstract: With the popularization and development of the Internet， the network outage urgently needs to be solved in academia and industry and becomes a hot research topic. Large-scale network outage events seriously affect operation of network services and infrastructures， while a deep understanding of them can help strengthen people’s control over network condition. According to the research progress of the latest network outage detection technology， firstly， the definition and cause of network outage are given， and the security threats caused by network outages is revealed. Secondly， the network outage detection technologies are summarized and their advantages and disadvantages are presented. And then， the existing data collection platforms leveraging for network outage detection are summarized. Finally， the research prospects of network outage detection are presented， which provides a reference for the follow-up research on network security.

Key words: Key words: network outage, detection technology, data collection platform, network security

CLC Number:

中图分类号：TP393

KUANG Ye1, ZHOU Mo2, LIU Ceyue1. A Survey of Network Outage Detection[J]. Computer and Modernization, 2025, 0(07): 43-54.

References

［1］陈华山，皮兰，刘峰，等. 网络空间安全科学基础的研究前沿及发展趋势［J］. 信息网络安全， 2015，15（3）:1-5.
［2］李留英. 基于大数据的网络空间安全战略的构建［J］. 数字图书馆论坛， 2014（2）:16-19.
［3］申志伟，辛叶舟. 基于新技术的网络空间安全架构分析［J］. 互联网天地， 2015（10）:20-23.
［4］ KISANGA P， WOUNGANG I， TRAORE I， et al. Network anomaly detection using a graph neural network［C］// The 2023 International Conference on Computing， Networking and Communications. IEEE， 2023: 61-65.
［5］ ROY B， ACHARYA I， PAPALKAR D， et al. Top-performing unifying architecture for network intrusion detection in SDN using fully convolutional network［C］// The 2023 5th International Conference on Inventive Research in Computing Applications. IEEE， 2023:1340-1344.
［6］ KUANG Y， LI D D， HUANG X H， et al. KL-Dection: An approach to detect network outages based on key links［J］. Wireless Communications and Mobile Computing， 2022，2022. DOI: 10.1155/2022/5099508.
［7］ KUANG Y， LI D D， HUANG X H， et al. On the modeling of RTT time series for network anomaly detection［J］. Security and Communication Networks， 2022. DOI: 10.1155/2022/5499080.
［8］ LEE B S， KIM J W， CHOI M J. Federated learning based network intrusion detection model［C］// The 2023 24st Asia-Pacific Network Operations and Management Symposium. IEEE， 2023:330-333.
［9］ GUMMADI A N， NAPIER J C， ABDALLAH M. XAI-IoT: An explainable AI framework for enhancing anomaly detection in IoT systems［J］. IEEE Access， 2024，12:71024-71054.
［10］ NAKIP M， GELENBE E. Online self-supervised deep learning for intrusion detection systems［J］. IEEE Transactions on Information Forensics and Security， 2024，19:5668-5683.
［11］ MARKOPOULOU A， IANNACCONE G， BHATTACHARYYA
S， et al. Characterization of failures in an operational IP backbone network［J］. IEEE/ACM Transactions on Networking， 2008，16（4）:749-762.
［12］ RUSSELL P， ELSAYED M A， NANDY B， et al. On the fence: Anomaly detection in IoT networks［C］// The 2023 IEEE/IFIP Network Operations and Management Symposium. IEEE， 2023. DOI: 10.1109/NOMS56928.
2023.10154271.
［13］ ACETO G， BOTTA A， MARCHETTA P， et al. A comprehensive survey on Internet outages［J］. Journal of Network & Computer Applications， 2018，113:36-63.
［14］ KUMARESAN S J， SENTHILKUMAR C， KONGKHAM D， et al. Investigating the effectiveness of recurrent neural networks for network anomaly detection［C］// The 2024 International Conference on Intelligent and Innovative Technologies in Computing， Electrical and Electronics. IEEE， 2024. DOI: 10.1109/IITCEE59897.2024.10467790.
［15］ SELVARAJAN P， SALMAN R， AHAMED S， et al. Networks intrusion detection using optimized hybrid network［C］// 2023 International Conference on Smart Computing and Application. IEEE， 2023. DOI: 10.1109/ICSCA57840.
2023.10087611.
［16］ INUI T， YASUTAKA T， ENDO K， et al. Geo-environmental issues induced by the 2011 off the Pacific Coast of Tohoku Earthquake and tsunami［J］. Soils and Foundations， 2012，52（5）:856-871.
［17］ GUPTA A， LAMBA H， KUMARAGURU P， et al. Faking sandy: Characterizing and identifying fake images on Twitter during hurricane sandy［C］// Proceedings of the 22nd International Conference on World Wide Web. IEEE， 2013:729-736.
［18］ COWIE J H， OGIELSKI A T， PREMORE B， et al. Impact of the 2003 blackouts on Internet communications［EB/OL］. （2023-11-21）［2024-05-10］. https://content.cooperate.com/pdf/blackout2003.pdf.
［19］ OGIELSKI A， COWIE J. Internet routing behavior on 9/11 and in the following weeks［EB/OL］. （2017-01-27）［2024-05-10］. https://silo.tips/download/internet-routing-
behavior-on-9-11.
［20］ POETRANTO I， SENFT A. Internet governance during crisis: The changing landscape of Thailand［C］// Global Internet Governance Academic Network. GigaNet， 2016. DOI: 10.2139/ssrn.2909377.
［21］ BROWN M A， ZMIJEWSKI E. Pakistan telecom hijacks YouTube: Or how to SYN-flood DOS yourself while annoying everyone on the planet［EB/OL］. ［2024-05-10］. https://resilinets.org/pakistan_telecom_hijacks_youtube.pdf.
［22］ MANSFIEDLD-DEVINE S. DDoS goes mainstream: How headline-grabbing attacks could make this threat an organisation’s biggest nightmare［J］. Network Security， 2016（11）:7-13.
［23］ DALEK J， HASELTON B， NOMAN H， et al. A method for identifying and confirming the use of URL filtering products for censorship［C］// Proceedings of the 2013 Conference on Internet Measurement Conference （IMC）. ACM， 2013:23-30.
［24］ Anonymous. The collateral damage of Internet censorship by DNS injection［J］. ACM SIGCOMM Computer Communication Review， 2012，42（3）:21-27.
［25］ DAINOTTI A， AMMAN R， ABEN E， et al. Extracting benefit from harm: Using malware pollution to analyze the impact of political and geophysical events on the Internet［J］. ACM SIGCOMM Computer Communication Review， 2012，42（1）:31-39.
［26］ GILL P， CRETE-NISHIHATA M， DALEK J， et al. Characterizing web censorship worldwide: Another look at the opennet initiative data［J］. ACM Transactions on the Web， 2015，9（1）. DOI: 10.1145/2700339.
［27］ SOBRINHO J L， LE F. A fresh look at inter-domain route aggregation［C］// Proceedings of the 2012 IEEE INFOCOM. IEEE， 2012:2556-2560.
［28］ WAN T， VAN OORSCHOT P C. Analysis of BGP prefix origins during Google’s May 2005 outage［C］// Proceedings 20th IEEE International Parallel & Distributed Processing Symposium. IEEE， 2006. DOI: 10.1109/IPDPS.2006.1639
679.
［29］ HIRAN R， CARLSSON N， GILL P. Characterizing large-scale routing anomalies: A case study of the China telecom incident［C］// Proceedings of the 14th International Conference on Passive and Active Measurement. ACM， 2013:229-238.
［30］ CETINKAYA E K， STERBENZ J P G. A taxonomy of network challenges［C］// 2013 9th International Conference on the Design of Reliable Communication Networks （DRCN）. IEEE， 2013:322-330.
［31］ BRODKIN J. Amazon EC2 outage calls “availability zones” into question［EB/OL］. （2011-04-21）［2024-05-10］. https://www.infoworld.com/article/2182374/amazon-ec2-outage-calls-availability-zones-into-question-3.html.
［32］ MEITEI I L， SINGH K J， DE T. Detection of DDoS DNS amplification attack using classification algorithm［C］// Proceedings of the International Conference on Informatics and Analytics. ACM， 2016:1-6.
［33］ MUSTAPHA H， ALGHAMDI A M. DDoS attacks on the Internet of things and their prevention methods［C］// Proceedings of the 2nd International Conference on Future Networks and Distributed Systems. ACM， 2018:1-5.
［34］王娜，杜学绘，王文娟，等. 边界网关协议安全研究综述［J］. 计算机学报， 2017，40（7）:1626-1648.
［35］黎松，诸葛建伟，李星. BGP 安全研究［J］. 软件学报， 2013，24（1）:121-138.
［36］ PADMANABHAN R， DHAMDERE A， Aben E， et al. Reasons dynamic addresses change［C］// Proceedings of the 2016 Internet Measurement Conference （IMC）. ACM， 2016:183-198.
［37］ KREIBICH C， WEAVER N， NECHAEV B， et al. Netalyzr: Illuminating the edge network［C］// Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement. ACM， 2010:246-259.
［38］ BENSON K， DAINOTTI A， CLAFFY C， et al. Leveraging Internet background radiation for opportunistic network analysis［C］// Proceedings of the 2015 Internet Measurement Conference （IMC）. ACM， 2015:423-436.
［39］ LUCKIE M， DHAMDHERE A， CLARK D， et al. Challenges in inferring Internet interdomain congestion［C］// Proceedings of the 2014 Conference on Internet Measurement Conference （IMC）. ACM， 2014:15-22.
［40］ CHOFFNES R D， BUSTAMANTE F E， GE Z H. Using the crowd to monitor the cloud: Network event detection from edge systems［C］// Proceedings of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2010.
［41］ SCHATZMANN D， LEINEN S， KÖGEL J， et al. FACT: flow-based approach for connectivity tracking［C］// International Conference on Passive and Active Network Measurement （PAM）. Springer， 2011:214-223.
［42］ GLATZ E， DIMITROPOULOS X. Classifying Internet one-way trafic［C］// Proceedings of the 2012 Internet Measurement Conference （IMC）. ACM， 2012:37-50.
［43］ BENSON K， DAINOTTI A， CLAFFY K C， et al. Gaining insight into as-level outages through analysis of Internet background radiation［C］// The 2013 IEEE Conference on Computer Communications Workshops （INFOCOM WKSHPS）. IEEE， 2013:447-452.
［44］ HEIDEMANN J， QUAN L， PRADKIN Y. A preliminary analysis of network outages during hurricane Sandy［EB/OL］. （2013-02-10）［2024-05-10］. https://ant.isi.edu/~johnh/PAPERS/Heidemann12d.pdf.
［45］ SUNDARESAN S， DENG X H， FENG Y， et al. Challenges in inferring Internet congestion using throughput measurements［C］// Proceedings of the 2017 Internet Measurement Conference （IMC）. ACM， 2017:43-56.
［46］ CHAN E W W， LUO X， FOK W W T， et al. Non-cooperative diagnosis of submarine cable faults［C］// International Conference on Passive and Active Network Measurement （PAM）. Springer， 2011:224-234.
［47］ FONTUGNE R， PELSSER C， ABEN E， et al. Pinpointing delay and forwarding anomalies using large-scale traceroute measurements［C］// Proceedings of the 2017 Internet Measurement Conference （IMC）. ACM， 2017:15-28.
［48］ WILSON E B. Probable inference， the law of succession， and statistical inference［J］. Journal of the American Statistical Association， 1927，22（158）:209-212.
［49］ LUCKIE M， BEVERLY R. The impact of router outages on the as-level Internet［C］// Proceedings of the Conference of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2017:488-501.
［50］ SENGUPTA S， KIM H， REXFORD J. Continuous In-network round-trip time monitoring［C］// Proceedings of the Conference of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2022:473-485.
［51］ RICHTER P， PADMANABHAN R， SPRING N， et al. Advancing the art of Internet edge outage detection［C］// Proceedings of the 2018 Internet Measurement Conference （IMC）. ACM， 2018:350-363.
［52］ WUSTROW E， KARIR M， BAILEY M， et al. Internet background radiation revisited［C］// Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement. ACM， 2010:62-74.
［53］ CZYZ J， LADY K， MILLER S G， et al. Understanding IPv6 Internet background radiation［C］// Proceedings of the 2013 Conference on Internet Measurement Conference （IMC）. ACM， 2013:105-118.
［54］ DAINOTTI A， SQUARCELLA C， ABEN E， et al. Analysis of country-wide Internet outages caused by censorship［C］// Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference （IMC）. ACM， 2011:1-18.
［55］ XIANG Q， HUANG C Y， WEN R D， et al. Beyond a centralized verifier: Scaling data plane checking via distributed， on-device verification［C］// Proceedings of the Conference of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2023:152-166.
［56］ TEIXEIRA R， REXFORD J. A measurement framework for pin-pointing routing changes［C］// Proceedings of the ACM SIGCOMM Workshop on Network Troubleshooting: Research， Theory and Operations Practice Meet Malfunctioning Reality. ACM， 2004:313-318.
［57］ WANG F， MAO Z M， WANG J， et al. A measurement study on the impact of routing events on end-to-end Internet path performance［C］// Proceedings of the 2006 Conference on Applications， Technologies， Architectures， and Protocols for Computer Communications. ACM， 2006:375-386.
［58］ SERMPEZIS P， KOTRONIS V， GIGIS P， et al. ARTEMIS: Neutralizing BGP hijacking within a minute［J］. IEEE/ACM Transactions on Networking， 2018，26（6）:2471-2486.
［59］ ZHANG M， ZHANG C， PAI V S， et al. PlanetSeer: Internet path failure monitoring and characterization in wide-area services［C］// Proceedings of the 6th Conference on Symposium on Operating Systems Design & Implementation. USENIX， 2004:167-182.
［60］ MILOLIDAKIS A， FONTUGNE R， DIMITROPOULOS X. Detecting network disruptions at colocation facilities［C］// The 2019 IEEE Conference on Computer Communications （INFOCOM）. IEEE， 2019:2161-2169.
［61］ ABEN E， KING A， BENSON K， et al. Lessons learned by “measuring” the Internet during/after the Sandy storm［EB/OL］. （2013-02-06）［2024-05-10］. https://www.caida.org/catalog/media/2013_lessons_learned_measuring_sandy_fcc/lessons_learned_measuring_sandy_fcc.pdf.
［62］ BAJPAI V， ERAVUCHIRA S J， SCHÖNWÄLDER J， et al. Vantage point selection for IPv6 measurements: Benefits and limitations of RIPE Atlas tags［C］// The 2017 IFIP/IEEE Symposium on Integrated Network and Service Management （IM）. IEEE， 2017:37-44.
［63］ HIRAN R， CARLSSON N， GILL P. Characterizing large-scale routing anomalies: A case study of the China telecom incident［C］// International Conference on Passive and Active Network Measurement （PAM）. Springer， 2013:229-238.
［64］ TANG A， BECKETT R， BENALOH S， et al. Lightyear: Using modularity to scale BGP control plane［C］// Proceedings of the Conference of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2023:94-107.
［65］ TEOH S T， RANJAN S， NUCCI A， et al. BGP eye: A new visualization tool for real-time detection and analysis of BGP anomalies［C］// Proceedings of the 3rd International Workshop on Visualization for Computer Security. ACM， 2006:81-90.
［66］ BUSH R， MAENNEL O， ROUGHAN M， et al. Internet optometry: Assessing the broken glasses in Internet reachability［C］// Proceedings of the 9th ACM SIGCOMM Conference on Internet Measurement. ACM， 2009:242-253.
［67］ GLASS K， COLBAUGH R， PLANCK M. Automatically identifying the sources of large Internet events［C］// 2010 IEEE International Conference on Intelligence and Security Informatics. IEEE， 2010:108-113.
［68］ DI BARTOLOMEO M， DI DONATO V， PIZZONIA M， et al. Extracting routing events from traceroutes: A matter of empathy［J］. IEEE/ACM Transactions on Networking， 2019，27（3）:1000-1012.
［69］ GIOTSAS V， DIETZEL C， SMARAGDAKIS G， et al. Detecting peering infrastructure outages in the wild［C］// Proceedings of the Conference of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2017:446-459.
［70］ FELDMANN A， MAENNEL O， MAO Z M， et al. Locating Internet routing instabilities［J］. ACM SIGCOMM Computer Communication Review， 2004，34（4）:205-218.
［71］ CAESAR M， SUBRAMANIAN L， KATZ R H. Root cause analysis of BGP dynamics［C］// Proceedings of the 2003 Internet Measurement Conference （IMC）. ACM， 2003.
［72］ JAVED U， CUNHA I， CHOFFNES D， et al. PoiRoot: Investigating the root cause of interdomain path changes［J］. ACM SIGCOMM Computer Communication Review， 2013，43（4）:183-194.
［73］ KATZ-BASSETT E， MADHYASTHA H V， JOHN J P， et al. Studying black holes in the Internet with Hubble［C］// Proceedings of the 5th USENIX Symposium on Networked Systems Design & Implementation. USENIX， 2008:247-262.
［74］ PAXSON V. End-to-end routing behavior in the Internet［J］. IEEE/ACM Transactions on Networking， 1997，5（5）:601-615.
［75］ KATZ-BASSETT E， SCOTT C， CHOFFNES D R， et al. LIFEGUARD: Practical repair of persistent route failures［J］. ACM SIGCOMM Computer Communication Review， 2012，42（4）:395-406.
［76］ KATZ-BASSETT E， CHOFFNES D R， CUNHA Í， et al. Machiavellian routing: Improving Internet availability with BGP poisoning［C］// Proceedings of the 10th ACM Workshop on Hot Topics in Networks. ACM， 2011: Article No. 11.
［77］ MIAO C C， XIAO Y M， CANINI M， et al. TENSOR: Lightweight BGP non-stop routing［C］// Proceedings of the Conference of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2023:108-121.
［78］ AUGUSTIN B， FRIEDMAN T， TEIXEIRA R. Measuring multipath routing in the Internet［J］. IEEE/ACM Transactions on Networking， 2011，19（3）:830-840.
［79］ GUNES M H， SARAC K. Resolving anonymous routers in Internet topology measurement studies［C］// The 27th IEEE Conference on Computer Communications （INFOCOM）. IEEE， 2008:1750-1758.
［80］ MARCHETTA P， PESCAPÉ A. DRAGO: Detecting， quantifying and locating hidden routers in traceroute IP paths［C］// The 2013 IEEE Conference on Computer Communications （INFOCOM）. IEEE， 2013:109-114.
［81］ MARCHETTA P， DE DONATO W， PESCAPÉ A. Detecting third-party addresses in traceroute traces with IP timestamp option［C］// International Conference on Passive and Active Network Measurement （PAM）. Springer， 2013:21-30.
［82］ SHAH A， FONTUGNE R， ABEN E， et al. Disco: Fast， good， and cheap outage detection［C］// The 2017 Network Traffic Measurement and Analysis Conference （TMA）. IEEE， 2017: 1-9.
［83］ QUAN L， HEIDEMANN J， PRADKIN Y. Trinocular: Understanding Internet reliability through adaptive probing［J］. ACM SIGCOMM Computer Communication Review. 2013，43（4）:255-266.
［84］ PADMANABHAN R， SCHULMAN A， LEVIN D， et al. Residential links under the weather［C］// Proceedings of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2019:145-158.
［85］ SCHULMAN A， SPRING N. Pingin’ in the rain［C］// Proceedings of the 2011 ACM SIGCOMM Conference on Internet Measurement Conference. ACM， 2011:19-28.
［86］ VAN BELLE G， FISHER L D， HEAGERTY P J， et al. Biostatistics: A Methodology for the Health Sciences［M］. 2ed. John Wiley & Sons， 2004.
［87］ PEARCE P， ENSAFI R， LI F， et al. Augur: Internet-wide detection of connectivity disruptions［C］// 2017 IEEE Symposium on Security and Privacy （SP）. IEEE， 2017:427-443.
［88］ JUNG J， PAXSON V， BERGER A W， et al. Fast portscan detection using sequential hypothesis testing［C］// 2004 IEEE Symposium on Security and Privacy （SP）. IEEE， 2004:211-225.
［89］ PADMANABHAN R， SCHULMAN A， DAINOTTI A， et al. How to find correlated internet failures［C］// International Conference on Passive and Active Network Measurement （PAM）. Springer， 2019:210-227.
［90］ FIADINO P， D‘ALCONZO A， BÄR A， et al. On the detection of network traffic anomalies in content delivery network services［C］// The 2014 26th International Teletraffic Congress （ITC）. IEEE， 2014. DOI: 10.1109/ITC.2014.6932930.
［91］ FONTUGNE R， MAZEL J， FUKUDA K. Hashdoop: A MapReduce framework for network anomaly detection［C］// The 2014 IEEE Conference on Computer Communications Workshops （INFOCOM WKSHPS）. IEEE， 2014. DOI: 10.1109/INFCOMW.2014.6849281.
［92］ GUILLOT A， FONTUGNE R， WINTER P， et al. Chocolatine: Outage detection for Internet background radiation［C］// 2019 Network Traffic Measurement and Analysis Conference（TMA）. IEEE， 2019. DOI: 10.23919/TMA.2019.
8784607.
［93］ PASCHALIDIS I C， SMARAGDAKIS G. Spatio-temporal network anomaly detection by assessing deviations of empirical measures［J］. IEEE/ACM Transactions on Networking， 2009，17（3）:685-697.
［94］ NEVAT I， DIVAKARAN D M， NAGARAJAN S G， et al. Anomaly detection and attribution in networks with temporally correlated traffic［J］. IEEE/ACM Transactions on Networking， 2018，26（1）:131-144.
［95］ ANTONIAK C E. Mixtures of Dirichlet processes with applications to Bayesian nonparametric problems［J］. The Annals of Statistics， 1974，2（6）:1152-1174.
［96］ ISHWARAN H， JAMES L F. Gibbs sampling methods for stick-breaking priors［J］. Journal of the American Statistical Association， 2001，96（453）:161-173.
［97］ FONTUGNE R， MAZEL J， FUKUDA K. An empirical mixture model for large-scale RTT measurements［C］// 2015 IEEE Conference on Computer Communications （INFOCOM）. IEEE， 2015:2470-2478.
［98］ ZUO X T， FANG C， HAN P. Network traffic anomaly detection based on spatio-temporal dynamic graph［C］// The 2024 IEEE 14th International Conference on Electronics Information and Emergency Communication （ICEIEC）. IEEE， 2024:221-225.
［99］ NGUYEN H X， THIRAN P. Active measurement for multiple link failures diagnosis in IP networks［C］// International Workshop on Passive and Active Network Measurement （PAM）. Springer， 2004:185-194.
［100］ ZHANG Y， PAXSON V， SHENKER S， et al. The stationarity of Internet path properties: Routing， loss， and throughput［EB/OL］. （2000-05-02）［2024-05-10］. https://www.scirp.org/reference/referencespapers?referenceid=372404.
［101］ XU K， CHANDRASHEKAR J， ZHANG Z L. A first step toward understanding inter-domain routing dynamics［C］// Proceedings of the 2005 ACM SIGCOMM Workshop on Mining Network Data. ACM， 2005:207-212.
［102］ ZHANG J， REXFORD J， FEIGENBAUM J. Learning-based anomaly detection in BGP updates［C］// Proceedings of the 2005 ACM SIGCOMM Workshop on Mining Network Data. ACM， 2005:219-220.
［103］ DESHPANDE S， THOTTAN M， HO T K， et al. An online mechanism for BGP instability detection and analysis［J］. IEEE Transactions on Computers， 2009，58（11）:1470-1484.
［104］ LI J， BROOKS S. I-seismograph: Observing and measuring Internet earthquakes［C］// The 2011 IEEE Conference on Computer Communications （INFOCOM）. IEEE， 2011:2624-2632.
［105］ CUNHA I， TEIXEIRA R， VEITCH D， et al. Predicting and tracking Internet path changes［C］// Proceedings of the Conference of the ACM Special Interest Group on Data Communication （SIGCOMM）. ACM， 2011:122-133.
［106］ KANUPARTHY P， LEE D H， MATTHEWS W， et al. Pythia: Detection， localization， and diagnosis of performance problems［J］. IEEE Communications Magazine， 2013，51（11）:55-62.
［107］ BANERJEE R， RAZAGHPANAH A， CHIANG L， et al. Internet outages， the eyewitness accounts: Analysis of the outages mailing list［C］// International Conference on Passive and Active Network Measurement （PAM）. Springer， 2015:206-219.
［108］ ZHANG Y X， DEBROY S， CALYAM P. Network-wide anomaly event detection and diagnosis with perfsonar［J］. IEEE Transactions on Network and Service Management， 2016，13（3）:666-680.
［109］ HUANG Y Y， FEAMSTER N， LAKHINA A， et al. Diagnosing network disruptions with network-wide analysis［J］. ACM SIGMETRICS Performance Evaluation Review， 2007，35（1）:61-72.
［110］ QUAN L， HEIDEMANN J， PRADKIN Y. Visualizing sparse Internet events: Network outages and route changes［J］. Computing， 2014，96（1）:39-51.
［111］ ZHONG Y， WANG Z L， SHI X G， et al. RFG-HELAD: A robust fine-grained network traffic anomaly detection model based on heterogeneous ensemble learning ［J］. IEEE Transactions on Information Forensics and Security， 2024，19 （3）:5895-5910.
［112］ MURAGODMATH A， SHAIKH A， BARAKER N， et al. An efficient network attack detection system using recurrent neural network models［C］// The 2024 5th International Conference for Emerging Technology （INCET）. IEEE， 2024. DOI: 10.1109/INCET61516.2024.10593098.
［113］ LUAN Y. Network Traffic anomaly detection based on federated learning［C］// The 2024 4th International Conference on Neural Networks， Information and Communication Engineering （NNICE）. IEEE， 2024: 224-228.

[1]	CHI Biwei1, SUN Rui2. DDoS Attack Detection Method Based on Transformer Architecture [J]. Computer and Modernization, 2025, 0(05): 36-40.
[2]	ZHANG Hong-bo, KUANG Yin-hu. Traffic Vehicle Flow Based on Video Detection Technology [J]. Computer and Modernization, 2014, 0(12): 58-63.