Internet traffic characterisation: third-order statistics & higher-order spectra for precise traffic modelling

Marnerides, A.K., Pezaros, D.P. and Hutchison, D. (2018) Internet traffic characterisation: third-order statistics & higher-order spectra for precise traffic modelling. Computer Networks, 134, pp. 183-201. (doi: 10.1016/j.comnet.2018.01.050)

[img]
Preview
Text
156916.pdf - Published Version
Available under License Creative Commons Attribution.

4MB

Abstract

Undoubtedly, the characterisation of network traffic flows is vitally important in understanding the dynamics of Internet traffic and in appropriately dimensioning network resources for network and systems management. The vast majority of modelling techniques developed for volume-based traffic profiling (based on packet and/byte counts) imply the statistical assumptions of stationarity, Gaussianity and linearity, which are often taken for granted without being explicitly validated. In this paper, we demonstrate that such properties are often not applicable due to the high fluctuations in Internet traffic, and should therefore be validated first before they are assumed. We employ Time-Frequency (TF) representations and the Hinich algorithms for validating these three modelling assumptions on real backbone and edge network traces. We show by conducting a passive, offline statistical analysis on real operational network traffic traces from both backbone and edge links that link traffic is extremely dynamic irrespective of the level of aggregation and that model characteristics vary. Subsequently, we propose the use of a representative of higher order spectra, the bispectrum, to act as a particularly suitable method for volume-based traffic profiling due to its ability to adapt to different underlying statistical assumptions, as opposed to ARIMA timeseries models that have been typically used in the literature. We demonstrate that the bispectrum, a signal processing tool that has so far been used in the area of image processing and acoustic signals, can be exploited to accurately characterise traffic volumes per transport protocol, and can therefore contribute to fine-grained network operations tasks such as application classification and anomaly detection.

Item Type:Articles
Status:Published
Refereed:Yes
Glasgow Author(s) Enlighten ID:Pezaros, Professor Dimitrios
Authors: Marnerides, A.K., Pezaros, D.P., and Hutchison, D.
College/School:College of Science and Engineering > School of Computing Science
Journal Name:Computer Networks
Publisher:Elsevier
ISSN:1389-1286
ISSN (Online):1872-7069
Published Online:07 February 2018
Copyright Holders:Copyright © 2018 The Authors
First Published:First published in Computer Networks 134:183-201
Publisher Policy:Reproduced under a Creative Commons License

University Staff: Request a correction | Enlighten Editors: Update this record

Project CodeAward NoProject NamePrincipal InvestigatorFunder's NameFunder RefLead Dept
643481A Situation-aware information infrastructureDimitrios PezarosEngineering and Physical Sciences Research Council (EPSRC)EP/L026015/1COM - COMPUTING SCIENCE
709131Network Measurement as a Service (MaaS)Dimitrios PezarosEngineering and Physical Sciences Research Council (EPSRC)EP/N033957/1COM - COMPUTING SCIENCE
722161FRuIT: The Federated RaspberryPi Micro-Infrastructure TestbedJeremy SingerEngineering and Physical Sciences Research Council (EPSRC)EP/P004024/1COM - COMPUTING SCIENCE
608831IMC2: Instrumentation, Measurement and Control for the CloudDimitrios PezarosEngineering and Physical Sciences Research Council (EPSRC)EP/L005255/1COM - COMPUTING SCIENCE