Akamai Diversity

Akamai Security Intelligence
& Threat Research

The Building Wave of Internet Traffic

The Novel Coronavirus, and the resulting viral respiratory illness caused by it, COVID-19, is changing our world. As much as possible, people around the world are practicing social distancing. This means working remotely for a large number of people, possibly for the first time in their lives. From Akamai's view, these changes led to a 30% growth in Internet traffic in March, causing many people to ask if the Web itself is going to "meltdown". The short answer is no. 

To quote our CEO, Dr. Tom Leighton:

Akamai operates a globally distributed intelligent edge platform with more than 270,000 servers in 4,000 locations across 137 countries. From our vantage point, we can see that global Internet traffic increased by about 30% during the past month. That's about 10x normal, and it means we've seen an entire year's worth of growth in Internet traffic in just the past few weeks. And that's without any live sports streaming, which continued to set new records prior to COVID-19. 

As much as we sometimes think of the Internet as being a single "entity", it isn't. It has, from the very beginning, been an amalgamation of smaller networks. Rather than growth coming from one network, or from one type of traffic, nearly every measure has spiked as much in one month as Akamai would normally see in a year. The various "swells" are combining into a huge wave of traffic, with video streaming and software download being responsible for the majority of growth.

By examining the traffic at the country level, we were able to see that regional concerns about COVID-19, and the implementation of isolation protocols, have had a significant impact on traffic levels. Just as the swell of different types of traffic affect the global levels, changes at the country level can impact both the local traffic and influence the regional traffic. 

The explosive growth in March is impressive, and only the future will tell if we continue to see similar growth. Media companies are taking steps to reduce their traffic, defaulting to standard definition streaming. Akamai is working with partners, like Sony and Microsoft, to limit the impact of patches to games and other software downloads by using off-peak hours for downloads. There will be challenges brought on by the sudden growth in traffic, but we're good at adapting to change.

We plan to present a series of posts over the coming weeks to highlight some of what we're seeing in Akamai's data. Today's post addresses the impact isolation protocols and stay at home orders have had on Internet consumption at a country level. 

Italy 

Italy was the first European Union country to go into isolation, and the growth of their traffic was relatively gentle in comparison to many other countries we analyzed. In Figure 1, we see the hourly traffic levels in the area plot, while the line shows us the daily average traffic level in the country. For more information on the data science behind these plots, please read the Behind the Scenes section at the end of this article.

Over the course of a week, Italy's daily traffic levels grew rapidly, peaking on March 14 at 75% over what average traffic levels were in February. Since then, it has receded until traffic on April 3 was less than 10% above February's average. This initial surge of traffic has been a common factor across most countries we've examined, as is a gradual ebb of the traffic in the following weeks. What makes Italy slightly different, is that the traffic didn't start until after isolation protocols took effect, but part of this may be because of natural weekend traffic patterns. 

Figure 1: The weekend suppressed the initial surge of internet traffic in Italy

One of the saving factors in the traffic created by pandemic concerns is that it has not been focused on a single time-frame or service, unlike a streaming media event or game release.  When multiple regions all attempt to download the same content at the same time, we see the impact of any slowdowns amplify. In contrast, because traffic growth is spread out across time and content more evenly, Akamai, and the Internet as a whole, have been able to adapt to the changes. The fact that we're seeing these surges come in waves, rather than all at the same time, gives us reassurance that the Internet will continue to function. 

Poland

Poland implemented isolation protocols on March 13, 2020, and followed a traffic pattern that became familiar to us as we looked across the European region. Three days before the country put their isolation protocols in place, we can see a steep incline in data usage inbound to Poland, with a gradual decline. As shown in the over/under plot in Figure 2, Internet traffic served by Akamai to Poland peaked on March 14, 2020, at slightly over 75% over February levels, before receding to less than 15% above the February average at the beginning of April.

Figure 2: Multiday spikes seem to represent a settling in period at the beginning of isolation

One consideration that complicates our analysis is several large spikes in global traffic, not just the region. On March 3rd, 2020, Akamai hit a major highwater mark driven primarily by a software update in a popular game. On March 10th, streaming coverage of European football and multiple patch releases established a new record of 167 Tbps delivered by Akamai's network. So, while the surge does start several days before isolation, it's not certain it was in anticipation of the actual event.

Spain

Looking at the traffic into Spain surrounding the isolation date, let's firm up the relation between isolation protocols and bandwidth usage. There were no significant events at the global level near the March 14, 2020 isolation order in Spain, which means the nearly 120% increase in traffic was almost certainly related. In most areas, weekend traffic is significantly depressed, which further highlights the stark growth we see in Figure 3. 

Figure 3: Spanish traffic patterns are highly similar to those of Poland and other parts of Europe

Luckily, we're seeing the initial demand recede as game patches are moved to off-peak hours and streaming services are defaulting to standard definition. Hovering at 20-30% above February's average, this new normal is a huge increase in Spain's traffic.

Conclusion

The core infrastructure of the Internet is under stress, and the symptoms were especially apparent in the early days, as isolation protocols were implemented across the world. Every country, every region, is reacting slightly differently, and while this staggered response may not be the perfect solution, it is allowing organizations across the globe to have some chance to react to unprecedented changes.

Even though we see aligning traffic peaks at the country level, the combined traffic doesn't exceed a hugely popular streaming event and software patch released on the same day. 

In addition, the gradual decline in traffic after the initial surge shows us that we need  to be prepared to serve at least 15-30% more traffic than we'd expected. Compressing a year's growth into a month will not come without growing pains, but it's not a catastrophic event, at least for the Internet. While the tide of the Internet is always rising, for now, we have a brief respite after a huge wave hit us.

Our next analysis will look at the impact of COVID-19 to traffic in the US as a whole and as individual states.  Check back in two weeks.


 Behind the scenes

This section is primarily for those deeply interested in the minutiae of data science and visualization. 

The plots above were developed using data from an internal Akamai tool called Netarch, short for Network Architecture. This is considered to be the most authoritative data source within Akamai, but the trade off for accuracy is speed. This lag influenced our choice to examine longer term trends, rather than put out a blog post as quickly as possible.

These plots look at all traffic across all solutions Akamai uses to deliver all types of traffic, from the relatively small code needed to build a web page, to highly demanding traffic for streams and software downloads. We have chosen not to differentiate traffic types in our current effort, in order to cut down on the complexity of our plots and the code that creates them. All code was written in R and draws heavily on the capabilities of ggplot.

Our input data contained average traffic levels per hour by country as the primary data point. This allowed us to extrapolate the daily average for each country. We used the average daily traffic across the month of February for each country as the baseline for our over/under plots. Absolute traffic numbers and scales were not approved for external publication, and required a blank y-axis for the area plots.

Finally, a note on time. In order to maintain consistency, we are defaulting to starting each week on Monday and ending on Sunday in all plots. This lets us compare 'Week 13' (March 24 - 29) consistently. It means our first full week of the year actually starts on December 30th, by SQL logic. All times are UTC, which has little impact on European maps, but seems to skew North/South American and Asian maps if not taken into account. Trying to perform the math needed to map time zones properly was well beyond the scope of this project.