Detecting Route Changes from RTT Measurements using XGBoost and Feature Engineering

• Thiago Prado de Azevedo Andrade UFF
• Bruno Llacer Trotti UFRJ
• Daniel Sadoc Menasché UFRJ

DOI: https://doi.org/10.5753/sbrc.2026.19266

Resumo

We address the route-change detection task of the Second Data Challenge CT-Mon/RNP 2025. Given consecutive traceroute measurements for a fixed origin–destination pair, the goal is to predict whether a route change occurred, using only last-hop RTT samples and probing metadata under extreme class imbalance. We propose a lightweight, pair-centric feature engineering pipeline that summarizes short-horizon RTT dynamics (e.g., step changes and deviations from rolling baselines), sampling irregularity, and reply/probe ratios, and trains a global XGBoost classifier with imbalance-aware weighting and validation-based threshold selection. On a held-out validation split, the resulting model achieves high discriminative performance (AUC-ROC 0.9956) and operates at a recall-oriented point (recall 0.93, precision 0.60 for route changes), making it suitable for monitoring and alerting applications. We further analyze gain-based feature importance, showing that consecutive RTT step differences and short-window deviations dominate the predictive signal.

Referências

Chen, T. and Guestrin, C. (2016). Xgboost: A scalable tree boosting system. In Proceedings of the 22nd ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining (KDD 2016), pages 785–794.

Cheng, Y., Cardwell, N., Dukkipati, N., Jha, P., and Yeganeh, A. (2021). The rack-tlp loss detection algorithm for tcp. RFC 8985.

Cheng, Y., Chu, J., Radhakrishnan, S., and Jain, A. (2013). Proportional rate reduction for tcp. RFC 6937.

de Almeida, C. M., Leão, R. M., and de Souza e Silva, E. (2025). Inferring change points in unlabelled time series data collected from the network diagnosis tool. Annals of Telecommunications, pages 1–18.

Hou, B., Hou, C., Zhou, T., Cai, Z., and Liu, F. (2021). Detection and characterization of network anomalies in large-scale RTT time series. IEEE Transactions on Network and Service Management, 18(1):793–806.

Measurement Lab (M-Lab) (2025). Traceroute data documentation. [link]. Accessed: 2025-10-13.

Mouchet, M. et al. (2019). Statistical characterization of round-trip times with nonparametric Hidden Markov Models. In 2019 IFIP/IEEE Symp. Integrated Network and Service Management, pages 43–48.

Mouchet, M., Vaton, S., Chonavel, T., Aben, E., and Den Hertog, J. (2020). Large-scale characterization and segmentation of Internet path delays with infinite HMMs. IEEE Access, 8:16771–16784.

Paxson, V. and Allman, M. (2011). Computing tcp’s retransmission timer. RFC 6298.

Pedregosa, F. et al. (2011). Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825–2830.

Shao, W. (2025). RTT change detection and correlation with path changes. [link]. GitHub repository, MIT License.

Shao, W., Rougier, J.-L., Paris, A., Devienne, F., and Viste, M. (2017). One-to-one matching of RTT and path changes. In 2017 29th International Teletraffic Congress (ITC 29), volume 1, pages 196–204. IEEE.