On the multiresolution structure of Internet traffic traces

1
1.1
Introduction
The problem
The object of this paper is the study of the behavior of Internet traffic, as observed on a network link (typically shared by a large number of network users), aiming to the identification, quantification, and justification of its salient N features. Traffic observation here assumes the form of data traces, i.e. sequences of the form {(ti , di )}i=1 , where di is a data quantity (possibly measured in bits, bytes etc.), and ti is its time stamp, the time when di was observed. N , with Throughout the paper, though, it will be more convenient to use binned data traces Xi∆ , i = 1, ..., M = t∆ ∆ bin size ∆, defined as: Xi = {j |i∆<tj <(i+1)∆} dj . Our ignorance of the exact procedures taking place in the network, due either to their complexity, or to lack of information, as well as of the behavior of its users, forces us to view X ∆ as a stochastic process [5]. This process has been the object of study of numerous researchers. It has unusual and initially unexpected properties, such as long range dependence [2, 7], nonstationarity [6, 9], and different behavior on different time scales [15, 18, 20, 16]. Moreover, even for the coarser time scales, its marginal distributions may be neither Gaussian, nor p-Stable. This is all the more surprising, since the Central Limit Theorems would lead one to expect the opposite, because a) the observed traffic is the aggregate result of many users, possibly acting independently [24, 10, 3] b) each Xi∆ is actually the sum of a large number of di ’s, and c) for small time bins, traffic is uncorrelated. Indeed, despite the fact that “bursts” and “spikes” seem to persist for at least 4 orders of bin magnitude (Fig. 1 and 2), which argues against a Gaussian limit, it can be easily seen, using classical fitting techniques, that the marginal distributions do not possess the characteristic heavy tails of p-Stable variables either; instead, their tails appear to be exponential or Weibull (Fig. 3). Thus, the process seems “unwilling” to converge to any limit, in contrast to most of the processes observed in nature or industry, which do not exhibit this type of “wild” behavior, but rather get “attracted” to the (Gaussian or p-Stable) central limit much sooner (this behavior will be quantified more precisely in section 5 below). The unusual properties of the traffic are generally attributed to the diversity of user applications, the network protocols, and the complexity of the network topology. Indeed, Internet traffic today is a result of numerous
1
(a)
(b)
(c)
(d)
(e)
(f)
Figure 1: Traces 94 -(a),(c),(e)- and 97 -(b),(d),(f)- binned with 3 different time bins: 1ms,100ms,1s. The data sets 94 and 97 are two of the eight data sets used in this paper; for more details, see section 1.2 below.
∗ A preliminary version of this paper appeared in Proceedings of SPIE Vol. 4868 (2002) under the title: “Some results on the multiresolution structure of Internet traffic traces”. † The author is a scholar of the Lilian Boudouris Foundation. ‡ The largest portion of the research for this paper was conducted while the author was affiliated to Princeton University, and was partially supported by AT&T Research Center.
February 1, 2008
Abstract Internet traffic on a network link can be modeled as a stochastic process. After detecting and quantifying the properties of this process, using statistical tools, a series of mathematical models is developed, culminating in one that is able to generate “traffic” that exhibits –as a key feature– the same difference in behavior for different time scales, as observed in real traffic, and is moreover indistinguishable from real traffic by other statistical tests as well. Tools inspired from the models are then used to determine and calibrate the type of activity taking place in each of the time scales. Surprisingly, the above procedure does not require any detailed information originating from either the network dynamics, or the decomposition of the total traffic into its constituent user connections, but rather only the compliance of these connections to very weak conditions.
On the multiresolution structure of Internet traffic traces∗
arXiv:math/0211307v2 [math.PR] 3 Feb 2003
Konstantinos Drakakis† Princeton University
Dragan Radulovi´ c‡ Yale University
2
(a)
(b)
(c)
(d)