maximum and minimum threshold of reasonable values are established based on previous trends. Since our dataset is frequently limited to a small amount of clients that are subject to varying network conditions and unrelated externalities, producing wide fluctuations in measurements, a Poisson distribution is established based on a rolling average. Detection of an abnormal event occurs when the trend breaches these bounds [@danezis2011anomaly].

Variance:

:   Internet Service Providers offer a diversity of products with varying levels of performance across different markets, leading to variations in qualities, such as connection speed and reliability. This technological and commercial variation is exacerbated by informal differences, such the scrutiny placed on the documentation necessary to obtain faster broadband implementation of administrative orders (elaborated in Section \[sec:controlgroups\]) and ability to acquire network infrastructure, despite scarcity created by sanctions and exchange rates. While these differences may change across time, there should be a consistent trend of diversity within a free market. We evaluate the variation that occur in service quality amongst our subgroups such as ISPs or prefixes. Therefore we presume that when external limitations are not imposed, variation will be high, while the contrapositive holds that at a time of control, the variation will be 