{"id":"9a22913f-3418-404b-b918-56e70dc497ac","arxiv_id":"2411.17958","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"Durbin uses per-network-block adaptive timebins in passive traffic to detect Internet outages as short as 5 minutes at /24 IPv4 and /48 IPv6 granularity, reporting the first IPv6 outage results.","lead":"This paper presents Durbin, a system that detects Internet outages by watching passive traffic from services like DNS servers and darknets, adapting detection precision to each network block. It reports short 5-minute outages at fine spatial scale and provides the first outage measurements for IPv6, which active probing cannot reach.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Durbin's short-outage and IPv6 claims rest on the assertion that its 78 Ms of extra outage beyond Trinocular are real 5-minute outages; the only external check is a 10.5k-block Disco comparison in §5.6, and re-reading that comparison as outage detection shows only ~53% outage precision.","rationale":"I agree with the reader's weakest assumption: the central accuracy numbers depend on treating Durbin's excess outage detections beyond Trinocular as real short outages, and the only direct evidence is the small §5.6 Disco comparison. My reading strengthens that concern by computing outage-oriented precision from Table 5: 53% of Durbin's outage events are confirmed by Disco, and the paper's reported PPV and recall use availability as the positive class, so they do not establish accuracy for the outage events that constitute the main contribution. The missing P(no|down) parameter and the absence of any IPv6 ground truth make it plausible that thresholds or traffic irregularity, rather than real failures, drive part of the reported short-outage and IPv6 outage fractions. I do not think this warrants rejection: the method is plausible, the two data sources and coverage analysis are useful, and the short-outage claim is empirically checkable. A high-frequency active probe campaign on a sample of Durbin-only outage blocks would directly test whether the excess outage seconds are real; until then, the appropriate verdict remains conditional. Since the reader already chose CONDITIONAL, my recommendation is UNCHANGED.","tokens_in":21705,"tokens_out":9837,"duration_ms":86613,"concrete_test":"Run a one-week high-frequency active validation: for a stratified random sample of ~300 Durbin-only outage blocks (where Durbin reports outage but Trinocular does not), send one ICMP echo or TCP SYN to port 53 every 60 seconds from three diverse vantage points, and compare measured unreachability windows against Durbin's 5-minute outage intervals. If fewer than 70% of Durbin-only outage events coincide with observed unreachability, the claim that the 78 Ms excess is real short outages fails; if alignment exceeds 90%, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline accuracy is driven by Table 2b (§5.1.3), the precision-aware comparison where Durbin reports 78,163,261 s of outage that Trinocular marks reachable, against only 13,147,965 s of agreed outage. The paper's central 'short outages' claim is that this 5.9× excess is real and simply invisible to Trinocular's 11-minute probing. The only external support is §5.6: a 7-day Disco/RIPE-Atlas comparison over 10.5k /24 blocks. Recomputing from Table 5 with outage as the event of interest: actual Disco outages = 2,030 true + 735 false-availability = 2,765; Durbin reports 2,030 of them (73% recall) and also reports 1,799 outage events Disco labels available, so only 2,030/(2,030+1,799) = 53% of Durbin's outage events agree with Disco. Moreover, the reported PPV (0.9769) and recall (0.9453) are computed for availability as the positive class, so they do not measure outage accuracy. This one independent check of the short-outage signal already shows about half of Durbin's outage detections are false relative to that ground truth, and it covers roughly 1% of the measurable IPv4 blocks. The global statements that ~5% of blocks have 5-minute outages and that omitting them undercounts duration by 15–20% are extrapolated from this sample with no representativeness argument. IPv6 (§5.1.5, §6.1) has no ground truth; the 10× IPv6 outage fraction could be inflated by the same false-positive mechanism, whether from sparse or periodic traffic, address churn, or the unspecified P(no|down) in Eqs. 1–2. Thus the load-bearing assumption is not yet supported: the 78 Ms excess must be shown to be signal, not threshold artifact, beyond 10.5k blocks and outside IPv4.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"Durbin is a passive outage-detection system that models expected traffic per /24 (IPv4) or /48 (IPv6) block and applies Bayesian belief updates to flag gaps in passive observations. The paper evaluates Durbin on B-root DNS and Merit darknet data, compares it with Trinocular and Disco, reports high availability-side positive predictive value, and claims detection of short (5-minute) outages in about 5% of blocks, a 15-20% increase in measured outage duration when short outages are included, and the first IPv6 outage measurements. The central design idea is per-block adaptation of temporal precision (5 or 25 minutes for B-root, 20 minutes for darknet) to trade coverage against accuracy.","tokens_in":22124,"tokens_out":8824,"duration_ms":75354,"significance":"The core idea of adapting timebin duration and measurability thresholds per block for passive outage detection is a reasonable and potentially useful contribution, and the evaluation scale is substantial: roughly 880k /24 blocks for the Trinocular comparison, 60k for the darknet comparison, and 10.5k blocks for the Disco comparison. The Bayesian formulation is simple, and the paper is honest about several limitations, including lack of IPv6 ground truth and the need for future work. However, the evidence for the two headline claims (short-outage detection and IPv6 outages) is currently indirect and, in the case of the Disco comparison, the reported metrics are availability-centric rather than outage-centric. If the short-outage and IPv6 claims could be validated with outage-class metrics and an artifact analysis, the contribution would be significant for network measurement.","major_comments":[{"comment":"The near-perfect recall of 0.9985 is obtained after discarding disagreements shorter than the block's timebin, which removes the very short false outages that dominate the raw comparison. The raw recall in Table 2a is 0.6282, with 31,087,360,212 s of false outage, while the filtered Table 2b reduces false outage to 78,163,261 s. Since the paper's main contribution is the ability to detect 5-minute outages, this filter suppresses precisely the events the paper claims to measure, so the precision-aware recall cannot be used as evidence for short-outage accuracy. The statement that the false-outage duration 'drops to one-quarter of before' is also arithmetically inconsistent with the two table values (the reduction is by a factor of roughly 398).","section":"§5.1.3, Table 2b"},{"comment":"The Disco comparison is the only external check of the short-outage signal, but its advertised PPV (0.9769) and recall (0.9453) define availability as the positive class. Re-reading the same table with outage as the event of interest gives 2,030 true outages, 1,799 false outages (FN), and 735 missed outages (FP), so Durbin's outage precision is about 53% and its outage recall about 73%. These numbers do not support the abstract and §1 claims that about 5% of blocks have short outages and that omitting them undercounts outage duration by 15-20%, especially because the comparison covers only 10.5k /24 blocks over seven days. Please report outage-class precision and recall and provide a representativeness argument or sensitivity analysis for the global extrapolation.","section":"§5.6, Table 5"},{"comment":"The claimed 20% true-negative-rate improvement from the hybrid 5/25-minute configuration is computed on the same B-root dataset used to select θsparse and the timebins, so the improvement may reflect tuning to this dataset. In addition, §3.3 uses P(no|down) in the belief equations but never gives its value, and the reported 25-minute TNR is 0.647 in §5.5 but 0.674 in §5.4.1 and Figure 5a. Please provide exact parameter values, a held-out or cross-validated evaluation, and a sensitivity analysis to show that the per-block adaptation, rather than the chosen operating point, is responsible for the reported gain.","section":"§5.5 and §3.5"},{"comment":"The IPv6 outage claim (first IPv6 measurements, roughly 10× the IPv4 outage fraction) has no ground truth, and §5.1.5 explicitly acknowledges this. The transfer argument from IPv4 rests only on similar marginal traffic-rate distributions in Figure 1; address churn or temporary IPv6 addresses would produce the same traffic gaps without an actual outage. The text value 'from 0.6 to 1.5' is also inconsistent with Figure 6, whose y-axis is 0.0-0.2, and with the stated 9% outage fraction. Please present IPv6 results as unvalidated measurements and test for address-churn and sparsity artifacts before drawing reliability conclusions.","section":"§6.1, Figure 6"}],"minor_comments":[{"comment":"The abstract contains a typo ('Durbin can report this results'); please proofread the manuscript.","section":"Abstract"},{"comment":"The sentence about outages 'as little as 5 minutes or less than 5 minutes' is too strong for a 5-minute timebin; sub-5-minute detection is not demonstrated by the current evaluation.","section":"§5.6"},{"comment":"The phrase 'from 0.6 to 1.5' appears to be a decimal error; the figure and the 9% statement suggest values around 0.06 to 0.15. Please verify the numbers against the figure.","section":"§6.1.1"},{"comment":"The rightmost bar mixes 5-minute dense blocks and 25-minute sparse blocks; please clarify how TNR is aggregated across blocks with different timebins so the comparison is interpretable.","section":"Figure 5a"},{"comment":"The phrase 'drops to one-quarter of before' should be corrected to reflect the approximately 398× reduction shown in Table 2b.","section":"§5.1.3"},{"comment":"Reference [41] lists a dataset URL with 'ant.edu'; please confirm that this is the correct institution and that the data are publicly accessible.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is candid about many limitations, but the headline numbers are currently presented in a way that overstates the support for the central claims. I believe the manuscript could be substantially improved by re-analyzing the existing comparisons with outage-centric metrics and by adding an explicit artifact check for the IPv6 result, so major revision seems more appropriate than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"John, quick take on the Durbin preprint. The core idea is genuinely new: per-block adaptive timebins for passive outage detection, 5 minutes for blocks with frequent traffic and 25 for sparse ones, while keeping /24 spatial granularity. That, plus the first IPv6 outage numbers, makes it worth reading even though the validation has a load-bearing weak spot.\n\nWhat the paper does well: the mechanism is simple and mostly sound. A Bayesian belief per address, merged at block level, with measurability thresholds. They test on two different passive sources, B-root and Merit darknet, which shows the approach generalizes. The comparisons to Trinocular and Disco are the right ones; the darknet evaluation is a good extra check.\n\nThe soft spot is exactly where the stress test lands. The headline recall of 0.9985 is computed after discarding disagreements shorter than the timebin, effectively assuming any short mismatch is phase noise. Raw recall is 0.6282. The central claim, that the extra 78 Ms of outage Durbin sees beyond Trinocular is real short outages, is supported by only one external check: the Disco comparison over 10.5k /24 blocks. Re-reading Table 5 from the paper, only 53% of Durbin's outage events agree with Disco; the reported PPV and recall are for availability as the positive class, not outage. So half the short-outage signal is unexplained. The global claims that about 5% of blocks have short outages and that omitting them undercounts duration by 15-20% are extrapolations from that small sample with no representativeness argument. IPv6 has no ground truth at all; the 10x higher outage fraction could easily be the same false-positive mechanism.\n\nThe parameters are also selected and evaluated on the same B-root data, so the 20% TNR improvement from the hybrid 5/25 scheme is partly tuned, not measured. And P(no|down), a required input to the Bayesian update, is never given a value.\n\nNone of this is fatal. The fix is straightforward: hold out data for parameter selection, report raw and precision-aware numbers side by side, specify P(no|down), and treat IPv6 as preliminary. This is exactly the kind of work that should get peer review, because the method is a real advance and the flaws are addressable, not structural. I would send it out, with the expectation of major revision.","headline":"Durbin's per-block adaptive passive detection is a genuine advance, but the short-outage and IPv6 claims rest on a validation that needs reworking before the paper is ready.","tokens_in":22736,"tokens_out":2837,"would_cite":true,"duration_ms":22894,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Durbin detects Internet outages from passive traffic with 5-minute and /24 precision by adapting detection timing per block.","keywords":["internet outage detection","passive measurement","per-block adaptivity","temporal precision","IPv6 outages","Bayesian inference","network reliability","DNS root traffic"],"falsifier":"Compare every Durbin 5-minute outage event in a sample of blocks against independent router-level ground truth, such as BGP update logs, router syslogs, or an ISP's own alarm data; if most events have no corresponding connectivity change, the short-outage claim is wrong. A cheaper check is to run the Durbin-versus-Disco comparison on all blocks where both systems have coverage instead of the 10.5k in the paper and see whether PPV and TNR survive.","tokens_in":21464,"feed_emoji":"📡","tokens_out":7675,"duration_ms":64686,"temperature":0.7,"pith_summary":"Durbin claims that passive observation of ordinary network traffic is enough to detect Internet outages with the fine spatial precision of active systems—/24 blocks in IPv4 and /48 blocks in IPv6—while adding temporal precision active systems cannot safely reach. The method learns, for each address block, how often traffic is expected to arrive, then chooses a short detection timebin (5 minutes) for frequently used blocks and a longer one (25 minutes) for sparse blocks, so accuracy does not collapse when data is thin. Against Trinocular's active measurements, Durbin reports near-perfect positive predictive value (0.9999) and good true negative rate (0.84), and against Disco it detects outages as short as five minutes with PPV 0.977. It also produces the first IPv6 outage measurements, covering about 15k /48 blocks. If these claims hold, outage monitoring no longer has to choose between seeing behind firewalls and seeing small, short failures.","feed_headline":"Passive traffic spots 5-minute outages active probes miss","feed_subtitle":"Per-block detection reaches /24 and /48 precision, sees behind firewalls, and delivers the first IPv6 outage results.","key_machinery":"The load-bearing mechanism is per-block parameter adaptation: for every address, Durbin estimates the probability $\\pi(a)$ that traffic appears in a timebin, chooses a short or long timebin $T(a)$ according to whether traffic is frequent or sparse, and feeds each timebin's positive-or-negative observation through a Bayesian belief update (Equations 1–2), clamping belief to $[0.1, 0.95]$. Address beliefs are combined into a block belief by taking the maximum, with block timebin set by the most sensitive address. This adaptivity is what lets one algorithm hold spatial precision constant at /24 (IPv4) and /48 (IPv6) while varying temporal precision from 5 to 25 minutes, and it is the reason coverage stays at about 85% of B-root blocks with TNR 0.811 instead of 0.647 for a fixed 25-minute timebin.","core_discovery":"The paper's central claim is that outage detection can be made adaptive per network block, and that this single change lets passive monitoring match active systems' spatial precision, beat their temporal precision, and extend to IPv6. Durbin models each address by its historical probability $\\pi(a)$ of producing traffic in a timebin of duration $T(a)$, and updates a Bayesian belief $B(a)$ after every timebin that does or does not contain traffic; block-level belief is the maximum over member addresses. Blocks with frequent traffic are assigned a 5-minute timebin, sparse blocks 25 minutes, and the block is declared down when belief falls below threshold $\\theta_b=0.6$. In validation against Trinocular over 880k shared /24 blocks, Durbin achieves PPV 0.9999 and TNR 0.8417 with a precision-aware comparison; against Disco on 10.5k blocks it detects 5-minute outages with PPV 0.9769, recall 0.9453, and TNR 0.7341. The paper reports that 5% of blocks have at least one 5-minute outage, that omitting 5–10 minute outages underestimates total outage duration by about 15–20%, and that IPv6 /48 blocks show outage fractions roughly ten times IPv4, with 12–13% of measurable blocks experiencing at least one outage per day.","pith_inferences":["A natural extension is to make the timebin continuous rather than choosing between 5 and 25 minutes, which could rescue some of the 15% of blocks that are currently unmeasurable; the paper flags this direction as future work.","The reported IPv6 outage fraction, about ten times IPv4, may be inflated by the smaller and noisier IPv6 passive sample; comparing Durbin's IPv6 detections against active IPv6 probes once a good hitlist exists would settle whether the gap is real.","The same per-block Bayesian machinery could be applied to active probing to cut probe traffic while catching short outages, since the belief model does not depend on whether the observations are passive or active.","If short outages are as common as reported, user-visible reliability is worse than active-only measurements suggest; providers and regulators should treat passive monitoring as a complementary source rather than a substitute."],"forward_implications":["Outage reports can now include networks behind firewalls, since passive traffic already crosses those firewalls; active systems cannot probe them.","Short outages of 5–10 minutes become visible, and including them raises estimated total outage duration by 15–20%, so prior active-only measurements systematically understate outage burden.","IPv6 outage measurement becomes practical for about 15k /48 blocks from DNS-root traffic alone, with coverage potentially expanding to hundreds of thousands of blocks if run on CDN or Wikipedia data.","Per-block timebin selection improves true negative rate by roughly 20 percentage points over a fixed coarse timebin while retaining broad coverage, so a single global sensitivity setting is not the right operating point.","With B-root, Durbin covers about 1M /24 IPv4 blocks, roughly one-fifth of Trinocular's coverage, and with a major website's data it could match or exceed active methods."],"supporting_citations":[{"why":"Provides the active-measurement baseline (Trinocular) against which Durbin's accuracy, PPV, recall, and TNR are computed.","marker":"[27]"},{"why":"Supplies the Disco short-outage ground truth from RIPE Atlas disconnections used to validate 5-minute outage detection.","marker":"[34]"},{"why":"Represents prior passive AS-level outage detection at 5-minute precision that Durbin improves upon by adding /24 spatial precision.","marker":"[14]"},{"why":"Prior passive /24 outage detection at one-hour temporal precision; its CDN coverage estimate anchors Durbin's potential-coverage discussion.","marker":"[29]"},{"why":"Documents billions of IPv6 addresses visible in NTP traffic, supporting Durbin's claim that passive sources could vastly expand IPv6 coverage.","marker":"[31]"},{"why":"Supplies the Gasser IPv6 hitlist coverage baseline to which Durbin's actual and potential IPv6 /48 coverage is compared.","marker":"[12]"},{"why":"Provides the RIPE Atlas measurement infrastructure that yields the disconnection ground truth Disco uses for short outages.","marker":"[38]"},{"why":"B-root DNS traffic is the primary passive data source on which Durbin's detection and validation are run.","marker":"[40]"}],"fun_headline_variants":["Adaptive passive detection finds 5-minute outages","Per-block adaptivity boosts passive outage detection","Durbin spots brief outages with adaptive passive analysis","Passive outage detection adapts to each /24 block","IPv6 outages measured via adaptive passive method"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the extra short outages Durbin reports beyond Trinocular are real network failures and not artifacts of its detection sensitivity; this was checked against Disco on only about 10.5 thousand /24 blocks, while the global short-outage and IPv6 claims rest on that check.","fun_headline_variants_meta":{"raw":{"variants":["Adaptive passive detection finds 5-minute outages","Per-block adaptivity boosts passive outage detection","Durbin spots brief outages with adaptive passive analysis","Passive outage detection adapts to each /24 block","IPv6 outages measured via adaptive passive method"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000436,"raw_usage":{"total_tokens":2306,"prompt_tokens":1120,"completion_tokens":1186,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":736,"completion_tokens_details":{"reasoning_tokens":1114}},"tokens_in":736,"tokens_out":1186,"duration_ms":9007,"temperature":1.0,"reasoning_tokens":1114,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T11:39:42.937686+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compare every Durbin 5-minute outage event in a sample of blocks against independent router-level ground truth, such as BGP update logs, router syslogs, or an ISP's own alarm data; if most events have no corresponding connectivity change, the short-outage claim is wrong. A cheaper check is to run the Durbin-versus-Disco comparison on all blocks where both systems have coverage instead of the 10.5k in the paper and see whether PPV and TNR survive.","supporting_citations":[{"cited_title":"Trinocular: Understand- ing internet reliability through adaptive probing","cited_arxiv_id":null,"evidence_quote":"Provides the active-measurement baseline (Trinocular) against which Durbin's accuracy, PPV, recall, and TNR are computed."},{"cited_title":"Disco: Fast, good, and cheap outage detection","cited_arxiv_id":null,"evidence_quote":"Supplies the Disco short-outage ground truth from RIPE Atlas disconnections used to validate 5-minute outage detection."},{"cited_title":"Chocolatine: Out- age detection for internet background radiation","cited_arxiv_id":null,"evidence_quote":"Represents prior passive AS-level outage detection at 5-minute precision that Durbin improves upon by adding /24 spatial precision."},{"cited_title":"Advancing the art of internet edge out- age detection","cited_arxiv_id":null,"evidence_quote":"Prior passive /24 outage detection at one-hour temporal precision; its CDN coverage estimate anchors Durbin's potential-coverage discussion."},{"cited_title":"IPv6 hitlists at scale: Be careful what you wish for","cited_arxiv_id":null,"evidence_quote":"Documents billions of IPv6 addresses visible in NTP traffic, supporting Durbin's claim that passive sources could vastly expand IPv6 coverage."},{"cited_title":"Strowes, Luuk Hendriks, and Georg Carle","cited_arxiv_id":null,"evidence_quote":"Supplies the Gasser IPv6 hitlist coverage baseline to which Durbin's actual and potential IPv6 /48 coverage is compared."},{"cited_title":"Ripe atlas: A global internet measurement network","cited_arxiv_id":null,"evidence_quote":"Provides the RIPE Atlas measurement infrastructure that yields the disconnection ground truth Disco uses for short outages."},{"cited_title":"B-Root DNS service","cited_arxiv_id":null,"evidence_quote":"B-root DNS traffic is the primary passive data source on which Durbin's detection and validation are run."}],"review_version":1}