Problem
BGP routing anomalies show up as two different failure modes: sharp message-count spikes, and slower sustained density shifts that never spike. A single detector tuned for one mode misses the other.
Approach
Two complementary detectors run over 60-second BGP message-count time series: BLT-MAD for spikes, ShakeAlert for sustained density shifts. Co-detections are merged into a high-confidence tier.
What I built
- BLT-MAD strips zero-count buckets before computing the median, so quiet BGP intervals don’t pull the baseline toward zero and mask real spikes (threshold τ = 5.0).
- ShakeAlert sets its neighborhood radius R = P95 − P5 of the frequency distribution, so the density threshold adapts to typical behavior rather than being inflated by the anomalies it’s detecting.
- A three-stage Go pipeline (parse → process → analyze) with one goroutine per RIS Live subscription and a lock-free hot path, exposed via a REST API feeding a live Chart.js dashboard.
- Dual-mode ingestion (live WebSocket vs. bz2 MRT replay) resolves at startup from a single config field; both paths produce identical message structs.
Result
When both detectors flag the same timestamp the record is upgraded in place to a third, high-confidence tier. That is high-precision classification without inflating the outlier counts.