A monitoring and alerting system for detecting a disruptive event on the Internet includes a data collection and wrapping module configured to process input data that includes messages produced by a network routing protocol, including a live stream of messages on the network, historical dumps of the message to a computer's file system, or both. An automated analysis engine includes analysis modules configured to analyze routing information and selected Internet behaviors from the input data. User output includes automated alerts to the user and an interactive analysis module. The analysis modules include a probabilistic origin hijack analysis module; a probabilistic route hijack analysis module; a Hidden Markov Model analysis module; a tensor decomposition and analysis module and a static topology analysis module; and a dynamic topology analysis module.