We propose and estimate an alternating renewal model describing the propagation of anomalies in a backbone internet network in the United States. Internet anomalies, either caused by equipment malfunction, news events or malicious attacks, have been a focus of research in network engineering since the advent of the internet over 30 years ago. This article contributes to the understanding of statistical properties of the times between the arrivals of the anomalies, their duration and stochastic structure. Anomalous, or active, time periods are modelled as periods containing clusters or 1s, where 1 indicates a presence of an anomaly. The inactive periods consisting entirely of 0s dominate the 0–1 time series in every link. Since the active periods contain 0s, a separation parameter is introduced and estimated jointly with all other parameters of the model. Our statistical analysis shows that the integer-valued separation parameter and five other non-negative, scalar parameters satisfactorily describe all statistical properties of the observed 0–1 series.

我们提出并估计一个交替更新模型，该模型描述了美国骨干互联网网络中异常的传播情况。自30年前问世以来，由设备故障，新闻事件或恶意攻击引起的Internet异常一直是网络工程研究的重点。本文有助于理解异常到达之间的时间，持续时间和随机结构的统计特性。异常或活动时间段建模为包含簇或1s的时间段，其中1表示存在异常。在每条链路中，完全由0组成的不活动时间段占主导地位的0-1时间序列。由于有效期包含0，引入分离参数，并与模型的所有其他参数一起进行估算。我们的统计分析表明，整数分隔参数和其他五个非负标量参数可以令人满意地描述观察到的0-1系列的所有统计特性。