Brownout

In electrical grids, a brownout is a partial reduction in power -- the lights dim but don't go out. The same thing happens with internet access. Governments don't always flip the kill switch. More often, they throttle mobile data during protests, slow specific services in certain regions, or quietly restrict traffic for a few hours and then restore it. These partial shutdowns are harder to detect than full blackouts, and that's exactly the point.

This tool detects them.

Brownout is an open-source detection system for partial internet shutdowns. It fuses data from 8 public monitoring APIs, runs 3 independent anomaly detectors, and produces daily alerts for 84 Russian administrative regions. The system currently tracks 1,916 autonomous systems (networks) and catches about 97% of documented shutdowns.

How it works

The pipeline runs nightly in four stages:

  collectors/         processors/          detectors/           dashboard/
 +--------------+   +--------------+    +----------------+   +-------------+
 | Cloudflare   |   |              |    |                |   |             |
 | IODA         |-->| daily panel  |--->| 3 detectors    |-->| React SPA   |
 | OONI         |   | features     |    | ensemble vote  |   | (live site) |
 | Tor, RIPEstat|   |              |    |                |   |             |
 +--------------+   +--------------+    +----------------+   +-------------+

1. Collectors pull the previous day's data from public APIs -- TCP reset rates, BGP signals, OONI censorship tests, Tor bridge usage, and more.
2. Processors assemble a daily panel (one row per region) and compute 105 engineered features covering traffic, routing, censorship, and circumvention patterns.
3. Detectors run three independent models and fuse their outputs:
   • Conformal LightGBM -- calibrated predictions with statistical guarantees
   • Isolation Forest -- unsupervised anomaly detection (catches patterns the supervised model misses)
   • Broadcast -- detects coordinated anomalies across multiple regions simultaneously
4. Dashboard displays results on a map with drill-down to individual regions.

Data sources

All data comes from public, freely available APIs:

Source	What it measures	Auth required
Cloudflare Radar	TCP reset/timeout rates, device type, regional traffic	API token (free)
IODA	BGP, darknet, and active probing signals	None
OONI	Website blocking tests, circumvention tool reachability	None
Tor Metrics	Bridge and relay user counts	None
RIPEstat	BGP update counts, prefix visibility	None

The only API that requires authentication is Cloudflare Radar, which offers free tokens.

Quick start

git clone https://github.com/denis989/internet-brownout.git
cd internet-brownout

# Python pipeline
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

# Set up API keys
cp .env.example .env
# Edit .env and add your Cloudflare Radar API token

# Run collectors (fetches yesterday's data)
python3 collectors/fetch_cf_tcp.py
python3 collectors/fetch_ioda_country.py
python3 collectors/fetch_ooni.py
python3 collectors/fetch_tor.py
python3 collectors/fetch_ripestat.py

# Process and detect
python3 processors/build_daily_panel.py
python3 processors/compute_features.py
python3 detectors/run_detectors.py
python3 processors/export_json.py

# Dashboard (separate install)
cd dashboard
npm install
npm run dev

The dashboard opens at http://localhost:5173. It reads from public/data/*.json -- the sample data is included so you can explore the UI immediately.

Current coverage

• Country: Russia
• Regions: 84 of 85 administrative subjects (Chukotka excluded -- insufficient ASN coverage)
• Networks: 1,916 autonomous systems (945 RU + 99 NL baseline)
• Detection performance: MCC = 0.773, recall = 97.3%, FPR = 22.5%
• Update frequency: Daily (nightly cron)

Live dashboard

A deployed instance is running at brownout.araminta-advisers.eu

Project structure

internet-brownout/
├── collectors/        8 scripts fetching data from public APIs
├── processors/        4 scripts: daily panel, features, isolation clock, JSON export
├── detectors/         3-model ensemble + training script + model configs
├── dashboard/         React 18 + Vite + D3 + Tailwind
├── visualizations/    13 matplotlib/seaborn scripts for publication figures
├── config/            ASN lists, region mappings, geographic IDs
├── scripts/           Pipeline orchestration and validation
└── data/              Generated at runtime (not in git)

License

MIT. See LICENSE.

Contact

Built by Denis Yagodin, CTO of Araminta Advisers gUG (Germany, nonprofit).