Measuring the Internet during Covid-19 to Evaluate Work-from-Home
MMeasuring the Internet during Covid-19to Evaluate Work-from-Home
Xiao Song
University of Southern [email protected]
John Heidemann
University of Southern [email protected]
ABSTRACT
The Covid-19 pandemic has radically changed our lives. Underdifferent circumstances, people react to it in various ways. One wayis to work-from-home since lockdown has been announced in manyregions around the world. For some places, however, we don’t knowif people really work from home due to the lack of information.Since there are lots of uncertainties, it would be helpful for us tounderstand what really happen in these places if we can detect thereaction to the Covid-19 pandemic. Working from home indicatesthat people have changed the way they interact with the Internet.People used to access the Internet in the company or at schoolduring the day. Now it is more likely that they access the Internetat home in the daytime. Therefore, the network usage changes inone place can be used to indicate if people in this place actuallywork from home. In this work, we reuse and analyze Trinocularoutages data (around 5.1M responsive /24 blocks) over 6 months tofind network usage changes by a new designed algorithm. We applythe algorithm to sets of /24 blocks in several cities and comparethe detected network usage changes with real world covid eventsto verify if the algorithm can capture the changes reacting to theCovid-19 pandemic. By applying the algorithm to all measurable /24blocks to detect network usages changes, we conclude that networkusage can be an indicator of the reaction to the Covid-19 pandemic.
KEYWORDS
Internet Measurement, Active Probing, Network Outages
In 2020, the Covid-19 pandemic has completely changed our lives.Media reports show millions of people are forced to stay at home,with some working from home and others becoming unemployed [4].However reactions to Covid-19 are not always certain. Public re-ports of Covid-19 responses (such as stay-at-home ) are not alwaystimely—the policy in some countries may be unclear, and its imple-mentation may be uneven. Even when a government establishes apolicy, the population may embrace or reject that policy, so actualparticipation of stay-at-home may diverge from stated policy [12].These reasons open questions about the accuracy of reports aboutstay-at-home.The Internet has changed the ways in which we interact withsociety, and Covid-19 has increased our Internet use [18]. As one
Permission to make digital or hard copies of part or all of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page. Copyrights for third-party components of this work must be honored.For all other uses, contact the owner/author(s). arXiv, Feb. 2021, Marina del Rey, California, USA © 2021 Copyright held by the owner/author(s). example, early in the pandemic streaming media providers reducedvideo quality to manage increased use [7]. Facebook reported asharp 20% increase in traffic in late March after widespread stay-at-home [6]. Researchers saw a similar 15–20% increase in traffic atIXPs in mid-March [13]. Changes depend on the perspective of theobserver: mobile (cellular) networks show a 25% drop in traffic anda decrease in user mobility as people stay at home [19]. While howthe Internet changes varies, these changes hold the potential toallow us to actually observe use and compliance with stay-at-homeorders, if they can be interpreted correctly.In this paper we look at
Internet address use as an indicationof stay-at-home . Many people use mobile devices (laptops, tables,smartphones) on the Internet at the home and office, and thesedevices acquire IP addresses when they are using the Internet. Oftenthese addresses are dynamically allocated using protocols such asDHCP. In many networks today, these dynamic allocations useprivate address space [25], in some cases these changes in use arevisible in the public IPv4 addresses space [9, 20, 21, 24, 29].Our premise is that we can see these changes in public IPv4address usage, and that it can be interpreted to indicate stay-at-home behavior. We expect to see increased address use at homenetworks and decreased use of office and school networks. We hopethat this information can provide information about stay-at-homeactivity in places where policies are unknown and about compliancewith stay-at-home in places where compliance is uncertain.We explore this question by developing new algorithms that canextract change of address usage from ongoing IPv4 address scanningfor Internet outage detection [23]. This approach has the advantageof broad, long-term, fine-grained coverage—measurements go to 4to 5 million /24 IPv4 networks, have taken place consistently since2014, and it provides new data about individual addresses every 11minutes. However, re-analysis of existing data requires care, sinceprobing rates vary and and the probing mechanism was tuned forother purposes.The first contribution of our work is to define a new algorithmthat shows how network usage changes over time for /24 blocks.We examine the active state of /24 blocks by counting the numberof active IPv4 addresses—those that reply to an ICMP echo request.The number of active IPv4 addresses represent network usage eachIPv4 address block. Prior work has shown we can observe diurnalpatterns in some blocks [24]. We show that changes in diurnalpatterns can indicate network usage changes that correlate withwork-from-home. To study regional changes, we use seasonal time-series decomposition followed by change-point detection to seehow all blocks geolocated to a region behave.The second contribution is to apply our algorithm to study 150k/24 blocks worldwide over the first six month of 2020. We ver-ify that our algorithm detects Covid-related work-from-home by a r X i v : . [ c s . N I] F e b rXiv, Feb. 2021, Marina del Rey, California, USA Xiao Song and John Heidemann evaluation of cities with lockdown events. For instance, the algo-rithm detects the network usage changes when Wuhan went onlockdown on 2020-01-23. We obverse a large network changes inManila, Philippine on 202-03-16. The observation matches the truththat Metro Manila went on lockdown on 2020-03-12. We also detectsthe change in New Delhi in late March. It matches the real worldCovid-19 event that Prime Minister of India ordered a nationwidelockdown on 2020-03-24.Our source data is already available at no cost, and we plan tomake the data resulting from our work and our analysis softwareavailable in early 2021. To detect changes in Internet use and infer work-from-home, webegin with address scans, then filter and analyze the data with thefollowing steps:(1) Identify active addresses by accumulating partial scans(2) Identify change-sensitive blocks(3) De-trend address usage(4) Detect changes in usage(5) Verify results from multiple observers
Tracking changes in active addresses requires regular, frequent,complete scans of the IPv4 address space. It is certainly possibleto scan all of IPv4 quickly, but frequent complete scans will drawabuse complaints and cause networks to filter our traffic. Ratherthan new, active probing, we instead turn to re-analyze ongoingprobing—leveraging existing probing not only places no additionalburden on the Internet (and no additional operational cost on us),but also allows us to re-examine years archived data.We use Trinocular outage data as our existing data source [23].Trinocular is an Internet outage detection system that scans ad-dresses in millions of IPv4 blocks every 11 minutes and has collecteddata 24x7 since November 2013. However, Trinocular is optimizedto minimize traffic on target networks—it cycles through all ad-dresses in each network in a randomly chosen (but deterministic)pattern, and probes only enough addresses to determine if the blockis reachable. Each round (11 minutes), it probes from 1 up to 15 or16 addresses [5]. In principle we could use other sources of activeaddress scans, provided they are complete and frequently updated.However, To our knowledge no other group currently makes avail-able scans that are incremental and cover all blocks multiple timesper day.Re-analysis of Trioncular begins by determining the state of alladdresses in the block by accumulating data over multiple Trinoc-ular rounds. We assume addresses do not change state until theyare re-scanned. We accumulate addresses until we have observedevery active address in the block. At that point, we begin updatingour prior estimate as new observations arrive. Thus we generatenew estimates of the number of active addresses every 11 minutes,but each estimate reflects data from multiple prior rounds.The exact time needed to report on all addresses in a block variesas function of how full the block is (we consider only addresses thathave been active in the last two years) and how many addresses - - - - - - - - - - - - - - - - - - - - d i u r n a l c h a n g e s o v e r w o r k - w ee k M L K h o li d a y P r e s i d e n t ' s d a y h o li d a y B e g i n C o v i d - w o r k - f r o m - h o m e d i u r n a l c h a n g e s a b s e n t the number of active ip addresesmaximum count of ever active address Figure 1: The number of active addresses for 128.9.144.0/24over 3 months. This change-sensitive block shows work-from-home begin on 2021-03-15, after weeks of peaks dur-ing workdays. respond (Trinocular stops scanning each round when it gets enoughresponses). In §4.3 we examine how long this takes in practice.The idea of our algorithm is to track the state of IP addresses(either up, down, or unknown) of /24 blocks for every 11 minutesround, keep updating the active states when the state of IP addressesare changed at this round, and count the number of active addressesof /24 blocks at specific time when all addresses in the ever-activelist have been probed.Once we have obtained the active states of all addresses that arein pre-generated ever-active IP addresses list, meaning no address ismarked as unknown, we then output the number of active addressesof the /24 blocks. The corresponding timestamp is the round inwhich all addresses in the ever-active list have a determined activestate. We regard all previous round as a full round.In the following round, as long as one address changes its activestate (from up to down or from down to up), we will output a newnumber of active addresses at that timestamp.
To detect work-from-home we must have blocks where addresschanges reflect people’s daily schedules. We call such blocks changesensitive , and identify them by two characteristics: first, they showa regular, diurnal pattern; second, they need to show enough swing (change) in the number of active addresses between day and nightthat we can detect changes in use with confidence.Figure 1 shows an example change-sensitive block. This graphshows the number of active addresses in this block over threemonths (the blue line). We usually see five clear bumps correspond-ing to the work week, followed by two days of flat behavior. Thisblock is at USC, so we confirm these changes correspond to lap-tops using DHCP-assigned IP addresses from discussions with thenetwork operators. In addition, these three months included two3-day weekends both of which show up with 4 (not 5) workdays. easuring the Internet during Covid-19 to Evaluate Work-from-Home arXiv, Feb. 2021, Marina del Rey, California, USA c u m u l a t i v e d i s t r i b u t i o n daily swing >= 5 Figure 2: Cumulative distribution of maximum daily swingof all diurnal blocks in 2020q1.
Our approach must look for blocks that reveal people’s dailywork schedules. To identify these blocks, we examine all ping-responsive blocks and look for blocks that show diurnal changesthat are large enough to reliable detect. We find more than 200kblocks meet these two requirements as we describe in §5.1.
Diurnal blocks:
We identify diurnal blocks by taking the FFT ofthe active-address time series and looking for energy in frequenciescorresponding to 24 hours (or harmonics of that frequency). Thisapproach follows that developed in prior work [24], which showedthat IP addresses often reflect diurnal behavior, particularly in Asia,South America, and Eastern Europe.
Persistent daily swing:
We look for blocks that have a “signif-icant” daily swing in addresses so we are not making decisions ofjust one or two addresses. We define the daily swing as the differ-ence between minimum and maximum number of active addressesover the midnight-to-midnight UTC 24-hour window .We define significant swing as a change of 5 or more addresses,based on evaluation of the data. (Too large a threshold will reducethe number of accepted blocks, but too small makes the algorithmvulnerable to noise.)Figure 2 shows that there are around 90% diurnal blocks whosemaximum daily swing are greater than 5.Although we require a daily swing, many blocks (like Figure 1)show use primarily during the work week and not on weekendsand holidays. We therefore require blocks to have a significant dailyswing for at least 4 of 7 consecutive days. We consider it as oneseasonal week. We filter blocks that have daily swing greater than5 and at least one seasonal week.
We look for diurnal blocks with swings to find blocks that reflectthe network usage at work, but daily fluctuations make it difficultto detect changes in use. We expect work-from-home will eitherremove the diurnal swing, as occurs in Figure 1 after 2020-03-15, or the overall use (and possibly also the size of the swing) will fallas fewer people come into work. Either way, we need to track the mean behavior over the course of a full 24 hours, assuming we“average in” any daily swing.We track the underlying baseline by applying a standard season-ality model to the data that decomposes the signal into a baselineconvolved with a daily and possibly weekly signal. We consideredtwo models: the “naive” seasonality model [26] and the Seasonal-Trend decomposition using LOESS (STL) [10, 26]. Although bothare similar, we adopted the STL for our work after comparing thetwo and finding it slightly more robust.Figure 3 shows the decomposition from our sample block (topgraph) from Figure 1 into trend, seasonal, and residual components(lower three graphs). We use the trend (second from top) to detectchanges that occur independent of the diurnal swing (seasonal) andnoise (residual). Finally, using STL trend as an estimate of the baseline, we can lookfor changes in that baseline.We apply a standard change-point detection algorithm, CUSUM [11,14]. CUSUM looks for changes in the baseline flags when the up-ward or downward trend begins, and identifies the specific point intime with largest change.Figure 4 shows an example with the raw data in the top graph,the STL trend second. The bottom graph shows cumulative increaseand decrease (purple and yellow colors), and we highlight start andend of changes on the trend line.This graph shows the change point detected by our algorithmfor 128.9.144.0/24. This is a change-sensitive block, with diurnalbehavior and a consistent address swing. We can observe the diurnalswing goes away around 2020-03-15 from both Figure 1 and theupper bar chart. The upper bar chart shows the time series of thenumber of active IP addresses of 128.9.144.0/24 over three months.The middle bar chart shows the trend of the time series. The reddot represents the time when a change point is claimed by thealgorithm. The bottom bar chart is the cumulative sums of thenormalized trend over time. The change point detected around2020-03-15 reflects the ground truth that work-from-home beginsat ISI/USC.We assume there are more work blocks that are change-sensitivethan home blocks, so we consider a downward change to indicateincreased work-from-home, and an upward change to signal areturn-to-work.In practice, if a downward change closely followed by a upwardchange, it is very likely to be an outage.This assumption is true if home networks are likely to either usea single, always-on IP address, as is the case in the U.S. and westernEurope, or that home networks are not using public IP addresses,as is the case in some countries like Iran.
The analysis above assumes a single Trinocular observer, but thereare multiple observers, each running with the same list of des-tinations, but independently. We can strengthen our results bycombining data from multiple observers, either to validate whatone sees, or to provide data more rapidly. rXiv, Feb. 2021, Marina del Rey, California, USA Xiao Song and John Heidemann o b s e r v e d t r e n d s e a s o n a l r e s i d u a l s Figure 3: Active addresses over time, the input data (top) and its STL decomposition into trend, seasonal, and residual compo-nents (lower three bars). We detect changes in the trend. Data: 128.9.144.0/24 for 2020q1. R a w d a t a N o r m a li z e d t r e n d Time series and detected changes (threshold= 1, drift= 0.001): N changes = 1
StartEndingAlarm0 2000 4000 6000 8000 100000.000.250.500.751.00 c u m u l a t i v e s u m s Time series of the cumulative sums of positive and negative changes +- Figure 4: Active addresses (top) with STL trend (middle) and CUSUM detection sums (bottom) for 128.9.144.0/24 in 2020q1. Ouralgorithm detects a change between 2020-03-08 and -18, triggering on 2020-03-14.
One can treat separate observers as equivalent but independent,validating the results against each other. We know that differentvantage points sometimes see different replies [15, 28]. We thereforerepeat analysis on observations from three different sites (currentlyLos Angeles, USA; Tokyo, Japan; and Utrecht, the Netherlands), toconfirm our results hold and avoid any vantage-point-specific bias.Alternatively, we can combine muliple results into a single, moretimely observation. Because Trinocular probes until it gets a pos-itive response, blocks with many positive responses are probedmore slowly, requiring nearly two days in the theoretical worstcase. Ideally we need to scan a block multiple times per day to de-tect diurnal behavior. Since observers are independent, combining multiple observers can reduce time to scan the full block. In §4.3,we prove that leveraging data from multiple observers can reducethe full block scanning time by 50%.
This paper uses the datasets listed in Table 1. All input data isavailable at no cost to other researchers, and we plan to make theresults of our available as well. easuring the Internet during Covid-19 to Evaluate Work-from-Home arXiv, Feb. 2021, Marina del Rey, California, USA abbr. dataset name start duration
Table 1: Datasets used in this paper. w: ISI-West in Los Angeles; j: Japan data from Keio University (SJF campus) near Tokyo;n: Netherlands data from SurfNet.
We first start with ground truth. We examine several blocks from theUniversity of Southern California where we can confirm changeswith the network operators.We are looking for data that shows USC’s switch to work-from-home. USC switched to online classes from 2020-03-11, on a trialbasis for one week. Spring recess stared on 2020-03-15, with manystudents leaving campus. USC resumed classes with distance learn-ing and work-from-home following spring recess.
We first examine the block 128.9.144.0/24, an address block allocatedto USC/ISI, a research lab with a mix of full-time researchers andstaff and students, using dataset 2020q1-w.Based on the discussion with network operators, addresses in128.9.144.0/24 are statically assigned to individual computers. Someaddresses are allocated to laptops that people bring in to work,but each of these laptops is assigned a unique IP addresses withDHCP. Other addresses in the block are for office computers thatare always on. Figure 1 shows the number of active addresses inthis block over 2020q1.We see between 8 and 18 addresses are active, with a baselineof 10 active addresses and workday “bumps” of 7 or 8 addresses.These bumps do not appear on weekends or holidays (2020-01-19and 2020-02-15 are U.S. national holidays). These results confirmour ability to see work-from-office our address space data.We see that the diurnal bumps go away starting 2020-03-15 withthe start of work-from-home—the laptops are now using addressesin home networks, not ones in this address block. In addition, wesee the baseline drops from 10 to 7, suggesting some always-oncomputers were shut down.Our change-point detection in Figure 4 shows three changesin usage: an increase at the beginning of January as researchersreturn to work after winter break, a slight dip around 2020-02-13when several always-on computers are turned off and there is a3-day weekend. Finally, there is a large change around 2020-03-15corresponding to start of work-from-home.This block illustrates the diurnal pattern with significant dailyswing that we look for, and shows how change-detection identifiesthe start of work-from-home. - - - - - - - - - - - - - - - - - - - - d i u r n a l c h a n g e s a b s e n t the number of active ip addresesmaximum count of ever active address Figure 5: The number of active addresses of 128.125.52.0/24over 2020q1. Thus USC block was the pre-covid VPN, withusage changing on 2020-03-15 with work-from-home.
We next consider 128.125.52.0/24, a block that is part of USC’s VPN.We initially determined it was VPN based on reverse DNS addresses,and then later confirmed this use with USC network operators.Figure 5 shows the number of active addresses over time. We seethat after 10 weeks of steady use, address use drops of significantly,just as work-from-home begins. This outcome seems backwardsfrom what one would expect—VPN use should go up with work-from-home. USC network operators indicated that they shiftedthe campus VPN to a newer, larger address space because of ananticipated increase in use. Thus use of this address space wentdown because use shifted to another block.Figure 6 confirms that this change in use is detected by ourchange-point detection. We observe the number of active IP ad-dresses has a significant drop around 2020-03-15 based on Figure 5and the upper bar chart of Figure 6. The change point detectedaround 2020-03-15 reflects the ground truth that work-from-homebegins at USC.Our detection algorithms find it, although they cannot (by them-selves) show that these users moved to a different address block.
Finally, we examine how quickly we get complete scans of each /24block. Prior work has suggested sparsely occupied blocks are fully rXiv, Feb. 2021, Marina del Rey, California, USA Xiao Song and John Heidemann R a w d a t a N o r m a li z e d t r e n d Time series and detected changes (threshold= 1, drift= 0.001): N changes = 1
StartEndingAlarm0 2000 4000 6000 8000 100000.00.20.40.60.81.0 c u m u l a t i v e s u m s Time series of the cumulative sums of positive and negative changes +- Figure 6: Active addresses (top), with STL trend (middle), and CUSUM cumulative sums (bottom) for 128.125.52.0/24, showingautomatic detection of the VPN changes on 2020-03-14. f r a c t i o n o f / b l o c k s H o u r s a39w-a39j-a39na39w Figure 7: Cumulative distribution of time to complete a fullscan of all known active addreesses in blocks, for a singleVP (the bottom line, VP w) and three VPs (top line, VPs w, j,and n). scanned in about two hours in the worst case [5], but that analysiscovered only the subset of all blocks that were intermittently re-sponsive. Here we care about change-sensitive blocks, a differentsubset, prompting a new analysis.Prior work placed bounds on the time. Full-block scanning (FBS)is a recent addition to Trinocular to address false outages in sparseblocks [5]. FBS requires evaluation of all active addresses in a block.FBS analysis suggesting 17 rounds (3.1 hours) as an upper boundfor scanning sparse blocks. This estimate assumes 15 probes perround and 256 addresses to cover in the block. In fact, a block whereall 256 addresses always respond will require 256 rounds (1.8 days).However, these worst cases are rare, and blocks where they occurare not change-sensitive, so our empirical time of 1 day is a muchbetter estimate of latency.Figure 7 shows that there are around 90% change-sensitive blockstake less than 1 day to scan the full block by using data collectedfrom single Trinocular observers. However, the upper plot showsthat there are around 73% change-sensitive blocks take less than 12 hours by using data collected from three Trinocular observers.The result indicate that combining data from multiple Trinocularobserver can significantly reduce the full block scanning time.
Our algorithms only work on change-sensitive blocks, not all blocks.We therefore first examine how many blocks are change-sensitiveand suitable for analysis.Table 2 shows data for the first half of 2020, with separate analysisof each quarter. Of the 5.1M responsive blocks, only about 223k arechange-sensitive in each quarter, and only 150k blocks are changesensitive in both quarters—only about 60% of blocks are consistentlychange-sensitive.The significant increase of responsive blocks in 2020q1 is due tothe expansion of address coverage. Starting from 2020q1, Trinocularexpand the coverage by pinging blocks with few live addresses. [5]This difference may be in part to changes due to Covid-19.
Prior analysis has shown that the number of diurnal blocks in eachcountry vary because different countries have different amounts ofIPv4 address space and different telecommunications policies.Figure 8 shows a map of where our coverage is best—we geolo-cate all change-sensitive blocks (with Maxmind GeoCities Light)and count blocks in each 2x2 degree latitude/longitude grid.We see that coverage is best in East Asia (China, Korea, andJapan), with some coverage in Brazil and North Africa, and sparsecoverage in the United States, Europe, and India. Coverage reflectsthe intersection of where IPv4 addresses are allocated and wherethose who use public IP addresses stop using them at night. Relativesparse results from the U.S. and Europe reflect a large number ofIPv4 address, but mostly using always-on-devices. We believe theheavier coverage in East Asia reflects local ISP policies. easuring the Internet during Covid-19 to Evaluate Work-from-Home arXiv, Feb. 2021, Marina del Rey, California, USA period: change sensitive
Finally, we look at real-world events in three different countries.We start by looking at China in January, since that was thecountry first affected by Covid-19. We then look at India and Philip-pines later in the quarter, looking at dates we discovered from ouralgorithms.For each case, we show our world-map with a 2x2 degree ge-ographic grid and the number of changed blocks as a heat-map.The color indicates the proportion of detected change points in the2x2 degree geographic grid on this day, from dark blue to whiteto red. We also show the line chart of the number of changes overtime for a given region.
Figure 9 shows our 2x2 degree grid ofchanges on 2020-01-26. The large number of white and light redcells shows that there is a large network change around this day.Figure 10 counts up the number of downward detections weobserve across all blocks for each day over six months. It showsthat there is a peak around 2020-01-26, indicating the network ocean (no networks)land (no networks)0.00.030.060.090.120.150.180.210.240.270.3 https://ant.isi.edu/diurnal/internet_outage_adaptive_a39w-20200101Copyright (C) 2021 by University of Southern California
Figure 9: The heatmap of fraction of change-sensitive blocksthat decrease on 2020-01-26, grouped by 2x2 degree cells.Many white cells in Wuhan, China correlate with theWuhan lockdown. usage drops significantly on that date—about 5% of change-sensitiveblocks show reduced usage.According to media reports, Wuhan went on lockdown on 2020-01-23 [22], confirming our peak of down-events occurs at the sametime as a Covid-19 event.
Figure 11 and Figure 12 show there was alarge network change in India on 2020-02-28. The 2x2 degree gridcell that is “hot” in this graph is in the state of Uttar Pradesh. Theline chart indicates that there are about 24% of change-sensitiveblocks show reduced usage.According to news, on 2020-02-23, Violence broke out betweenpolice and anti-citizenship law protesters in the area of Uttar Pradesh’sAligarh. Following the clashes, the mobile internet was suspendedfor a six-hour period [8]. This event is not Covid-19-related, but itis a change in Internet usage for a different type of social change.
Figure 13 shows our 2x2 degree gridof changes on 2020-03-16. The light red cell in Manila, Philippine rXiv, Feb. 2021, Marina del Rey, California, USA Xiao Song and John Heidemann - - - - - - - - - - - - - - - - - - - - - - - - - - date0.000.050.100.150.200.250.30 f r a c t i o n b l o c k s s h o w i n g d o w n ( r e d ) o r u p ( b l u e ) up trenddown trend Figure 10: The fraction of blocks that decrease (light red) orincrease (dark blue) usage in Wuhan, China for 2020q1 andq2. ocean (no networks)land (no networks)0.00.030.060.090.120.150.180.210.240.270.3 https://ant.isi.edu/diurnal/internet_outage_adaptive_a39w-20200101Copyright (C) 2021 by University of Southern California
Figure 11: The heatmap of fraction of change-sensitiveblocks that decrease on 2020-02-28, grouped by 2x2 degreecells. We see white grid cells across much of India, but par-ticularly in Uttar Pradesh in northern India on 2020-02-28.We believe these are related to Internet shutdowns follow-ing protests against the Citizenship Amendment Act. shows that there is a large network change around this day. Fig-ure 14 shows the large fraction of downward detections on 2020-03-16 as well. It indicates the network usage drops significantly—about 24% of change-sensitive blocks show reduced usage on thatdate.This date is shortly after lockdown in Metro Manila on 2020-03-12 [27].
Figure 16 shows a peak of downward de-tections on 2020-03-23 in New Delhi, with usage falling in about12% of change-sensitive blocks in that period. Figure 15 illustratesthe change of behaviors in India.Based on media reports, Prime Minister of India ordered theJanata curfew on 2020-03-22 [17]. This event shows our methoddetecting a change corresponding to a Covid-19-related lockdown. - - - - - - - - - - - - - - - - - - - - - - - - - - date0.000.050.100.150.200.250.30 f r a c t i o n b l o c k s s h o w i n g d o w n ( r e d ) o r u p ( b l u e ) up trenddown trend Figure 12: The fraction of blocks that decrease (light red) orincrease (dark blue) usage in Uttar Pradesh, India for 2020q1and q2. ocean (no networks)land (no networks)0.00.030.060.090.120.150.180.210.240.270.3 https://ant.isi.edu/diurnal/internet_outage_adaptive_a39w-20200101Copyright (C) 2021 by University of Southern California
Figure 13: The heatmap of fraction of change-sensitiveblocks that decrease on 2020-03-16, grouped by 2x2 degreecells. Many white cells in Manila, Philippines correlate withthe Manila lockdown.
This report presents two contributions. First, we develop a newalgorithm that shows how network usage changes over time for /24blocks. We demonstrate the approach works on sample blocks withknown events. Second, we analyze IPv4 address usage changes todetect decreases in usage that often correlate with Covid-19-inducedwork-from-home. We apply it to 150k /24 blocks for 6 months of2020, identifying several changes in usage that correspond to Covid-19 lockdown events. Although our work is still early—we are in theprocess of more careful validation—we believe our approach showsthe potential to relate IPv4 address use with societal changes.
ACKNOWLEDGMENTS
This work is partially supported by the project “Measuring theInternet during Novel Coronavirus to Evaluate Quarantine (RAPID-MINCEQ) ” (NSF 2028279), and John Heidemann’s work is partially easuring the Internet during Covid-19 to Evaluate Work-from-Home arXiv, Feb. 2021, Marina del Rey, California, USA - - - - - - - - - - - - - - - - - - - - - - - - - - date0.000.050.100.150.200.250.30 f r a c t i o n b l o c k s s h o w i n g d o w n ( r e d ) o r u p ( b l u e ) up trenddown trend Figure 14: The fraction of blocks that decrease (light red) orincrease (dark blue) usage in Minila, Philippines 2020q1 andq2. ocean (no networks)land (no networks)0.00.030.060.090.120.150.180.210.240.270.3 https://ant.isi.edu/diurnal/internet_outage_adaptive_a39w-20200101Copyright (C) 2021 by University of Southern California
Figure 15: The heatmap of fraction of change-sensitiveblocks that decrease on 2020-03-23, grouped by 2x2 degreecells. Many white and light red cells in New Delhi, India cor-relate with the Janata curfew. supported by the project “CNS Core: Small: Event Identification andEvaluation of Internet Outages (EIEIO)” (CNS-2007106). We thankGuillermo Baltra for prototyping analysis of Trinocular addressesacross a block, his involvment in early versions of this work, andhis comments on the work. We thank Yuri Pradkin for collectingthe Trinocular data that we use in our analysis.
REFERENCES [1] APNIC. 2020. Routing Table Report - Japan view. https://mailman.apnic.net/mailing-lists/bgp-stats/archive/2019/10/msg00001.html[2] APNIC. 2020. Routing Table Report - Japan view. https://mailman.apnic.net/mailing-lists/bgp-stats/archive/2020/01/msg00001.html[3] APNIC. 2020. Routing Table Report - Japan view. https://mailman.apnic.net/mailing-lists/bgp-stats/archive/2020/04/msg00001.html[4] ChaeWon Baek, Peter B McCrory, Todd Messer, and Preston Mui. 2020. Unem-ployment effects of stay-at-home orders: Evidence from high frequency claimsdata.
Review of Economics and Statistics (2020), 1–72.[5] Guillermo Baltra and John Heidemann. 2020. Improving Coverage of InternetOutage Detection in Sparse Blocks. In
Proceedings of the Passive and ActiveMeasurement Conference (johnh: pafile). Springer, Eugene, Oregon, USA. https: - - - - - - - - - - - - - - - - - - - - - - - - - - date0.000.050.100.150.200.250.30 f r a c t i o n b l o c k s s h o w i n g d o w n ( r e d ) o r u p ( b l u e ) up trenddown trend Figure 16: The line chart of detected network usage changesover time in New Delhi, India.
Proceedings of theACM Internet Measurement Conference . 34–41.[7] Jon Brodkin. 2020. Netflix, YouTube cut video quality in Europe afterpressure from EU official. Ars Technica https://arstechnica.com/tech-policy/2020/03/netflix-and-youtube-cut-streaming-quality-in-europe-to-handle-pandemic/. https://arstechnica.com/tech-policy/2020/03/netflix-and-youtube-cut-streaming-quality-in-europe-to-handle-pandemic/[8] Zee Media Bureau. 2020. Anti-CAA protest: Internet services suspended inAligarh after protesters-police clash. https://zeenews.india.com/india/anti-caa-protest-internet-services-suspended-in-aligarh-after-protesters-police-clash-2265646.html[9] Xue Cai and John Heidemann. 2010. Understanding Block-level Address Usagein the Visible Internet. In
Proceedings of the ACM SIGCOMM Conference (johnh:pafile). ACM, New Delhi, India, 99–110. https://doi.org/10.1145/1851182.1851196[10] Robert B Cleveland, William S Cleveland, Jean E McRae, and Irma Terpenning.1990. STL: A seasonal-trend decomposition.
Journal of official statistics
6, 1 (1990),3–73.[11] M. Duarte. 2020. detecta: A Python module to detect events in data. https://github.com/demotu/detecta.[12] Reid J. Epstein and Kay Nolan. 2020. A Few Thousand Protest Stay-at-Home Order at Wisconsin State Capitol.
New York Times
Proceedings of the ACM InternetMeasurement Conference (johnh: pafile). ACM, Pittsburgh, PA, USA, 1–18. https://doi.org/10.1145/3419394.3423658[14] Fredrik Gustafsson and Fredrik Gustafsson. 2000.
Adaptive filtering and changedetection . Vol. 1. Citeseer.[15] John Heidemann, Yuri Pradkin, Ramesh Govindan, Christos Papadopoulos,Genevieve Bartlett, and Joseph Bannister. 2008. Census and Survey of the VisibleInternet. In
Proceedings of the ACM Internet Measurement Conference
New York Times
Proceedings of the ACM Internet MeasurementConference (johnh: pafile). ACM, Pittsburgh, PA, USA, 19–33. https://doi.org/10.1145/3419394.3423655 rXiv, Feb. 2021, Marina del Rey, California, USA Xiao Song and John Heidemann [20] Giovane C. M. Moura, Carlos Ga nán an Qasim Lone, Payam Poursaied, HadiAsghari, and Michel van Eeten. 2015. How Dynamic is the ISPs Address Space?Towards Internet-Wide DHCP Churn Estimation. In
Proceedings of the IFIP Net-working (johnh: pafile). IFIP, xxx. https://doi.org/10.1109/IFIPNetworking.2015.7145335[21] Ramakrishna Padmanabhan, Amogh Dhamdhere, Emile Aben, kc claffy, and NeilSpring. 2016. Reasons Dynamic Addresses Change. In
Proceedings of the ACMInternet Measurement Conference (johnh: pafile). ACM, Santa Monica, CA, USA,183–198. https://doi.org/10.1145/2987443.2987461[22] The Associated Press. 2020. Timeline: China’s COVID-19 outbreak and lockdownof Wuhan. https://abcnews.go.com/Health/wireStory/timeline-chinas-covid-19-outbreak-lockdown-wuhan-75421357[23] Lin Quan, John Heidemann, and Yuri Pradkin. 2013. Trinocular: Understand-ing Internet Reliability Through Adaptive Probing. In
Proceedings of the ACMSIGCOMM Conference (johnh: pafile). ACM, Hong Kong, China, 255–266. https://doi.org/10.1145/2486001.2486017[24] Lin Quan, John Heidemann, and Yuri Pradkin. 2014. When the Internet Sleeps:Correlating Diurnal Networks With External Factors. In
Proceedings of the ACMInternet Measurement Conference (johnh: pafile). ACM, Vancouver, BC, Canada, 87–100. https://doi.org/10.1145/2663716.2663721[25] Y. Rekhter, B. Moskowitz, D. Karrenberg, G. J. de Groot, and E. Lear. 1996.
AddressAllocation for Private Internets . RFC 1918. Internet Request For Comments. ftp://ftp.rfc-editor.org/in-notes/rfc1918.txt[26] Skipper Seabold and Josef Perktold. 2010. Statsmodels: Econometric and statisticalmodeling with python. In
Proceedings of the 9th Python in Science Conference
Proceedings of the ACM InternetMeasurement Conference (johnh: pafile). ACM, Pittsburgh, PA, USA, 662–679.https://doi.org/10.1145/3419394.3424214[29] Yinglian Xie, Fang Yu, Kannan Achan, Eliot Gillum, Moises Goldszmidt, andTed Wobber. 2007. How Dynamic are IP Addresses?. In