Estimating Method of Short-Interval-Traffic Distribution Considering Long-Term-Traffic Dyna

1110IEICE MUN.,VOL.E89–B,NO.4APRIL2006P APER Special Section on Internet Technology VIEstimating Method of Short-Interval-Traffic Distribution Considering Long-Term-Traffic Dynamics for MultimediaQoS Management∗Tadayoshi FUKAMI†,Nonmember,Hiroki NISHIKA W A††,Takuya ASAKA†††a),Members,Tatsuro TAKAHASHI†††,Fellow,and Noriteru SHINAGA W A††,MemberSUMMARY Analyzing short-interval-traffic behaviors is important for network performance management to realize high quality multimedia ap-plications.However,it is difficult to measure short-interval-traffic vol-umes because there are complications in collecting short-interval-traffic data from routers.An example is a heavy load on routers or inaccurate measurement by the short-polling interval;it even demands expensive mea-surement tools.To resolve these disadvantages,an estimating method of short-interval-traffic distribution(EMSIT)has been proposed.This method estimates short-interval-traffic distributions using MIB(Management In-formation Base)data,which collects traffic volumes in cycles of several minutes.In this paper,we propose a new estimation method(EMSIT-LD) based on EMSIT,which applies to the case of long-term-traffic dynamics. We evaluate it using computer simulations and actual traffic data.key words:network traffic,passive measurement,traffic dynamics1.IntroductionThe rapid spread of the Internet has increased the demand for effective network management systems and for provid-ing high-quality network services for its users.However,the current network management systems for the Internet face many difficulties,and we have no clear grasp of the network traffic behaviors in spite of our efforts.It is impossible to understand systematically the network traffic on the Internet because the Internet is an aggregation of many autonomous network systems,and there is an enormous variety of dif-ferent network traffic on it.Therefore,network traffic mea-surement is inseparable from network management;in other words,network traffic measurement is the most important technology for use with network management,and thefirst step in implementing it.Especially,a traffic measurement technique with a large volume of information will become increasingly significant for QoS management of multimedia applications such as live-streaming or V oIP in the future.Today,many traffic measurement tools have been im-Manuscript received July1,2005.Manuscript revised September29,2005.†The author is with NTT DoCoMo Kansai Inc.,Osaka-shi, 530-0001Japan.††The authors are with NTT DoCoMo Inc.,Tokyo,100-6150 Japan.†††The authors are with the Graduates School of Informatics, Kyoto University,Kyoto-shi,606-8501Japan.∗Part of this paper was presented at IEEE Globecom2004,in November-December2004.a)E-mail:asaka@i.kyoto-u.ac.jpDOI:10.1093/ietcom/e89–b.4.1110plemented and a large number of network quality measuringprojects have been launched[1]–[4].Network administra-tors choose them according to the network traffic to be mea-sured.For example,we choose passive measurement toolswhen measuring long-term-traffic dynamics or their corre-lations at a local point on networks.On the other hand,wechoose active measurement tools when measuring an avail-able bandwidth or RTT on an End-to-End path.In case weobserve network traffic continuously,we should use trafficmeasurement tools that are easier and less expensive oper-ate.A network traffic measurement method with MIB(Man-agement Information Base)on a router satisfies these re-quirements.It outputs the throughputs every unit-time witha SNMP(Simple Network Management Protocol)[5].The World Wide Web(WWW)generates an ever-growing proportion of traffic on the Internet,and networkquality intervals of a few seconds,such as8s,is importantfor the Web,because such a short interval corresponds to thetime taken to display an entire Web page on a screen.Thus,measuring traffic dynamics periods of a few seconds is animportant aspect of network performance management.Ifthe traffic distribution in a few seconds were measured,net-work administrators could manage network qualities at the α%point of its distribution(such as the80%point),where we define traffic distribution in a few seconds as traffic distri-bution which is calculated by traffic data measured in cyclesof a few seconds.In other words,the administrators coulddetermine“the worst-case quality”represented by the tail ofthe traffic distribution.Thus,in this paper,we treat an orderof a second as a“Short interval.”The target for network management in this paper is toobserve short-interval traffic distribution of the minute-levelorder interval in the steady state,such as20min,and to op-erate network resources to allocate appropriately in an orderof more than just minutes.Examples of these operations areshown below.(1)Link capacity planning(2)Accommodation planning of access links to back-bone links(3)Planning of L2path routing(4)Network information disclosure to usersMost conventional methods and tools have shortcom-ings in measuring short-interval traffic volumes[9].For ex-ample,using a MIB(Management Information Base)andCopyright c 2006The Institute of Electronics,Information and Communication EngineersFUKAMI et al.:ESTIMATING METHOD OF SHORT-INTERV AL-TRAFFIC DISTRIBUTION1111Fig.1Tra ffic volume to be measured.SNMP (Simple Network Management Protocol)[5],[7],[8]with a short-polling-interval imposes a heavy load on a router,and these measurements may be inaccurate.Fur-thermore,probe hardware devices [6],protocol analyzers,and PCs can also collect many types of tra ffic information,but they are expensive,especially for high-speed links.To make matters worse,simultaneous measurements of many links require many such expensive devices.To resolve these di fficulties,an estimating method of a short-interval-tra ffic distribution (such as tra ffic distribution during a few seconds)has been proposed which we hereafter call EMSIT(an Estimating Method of Short-Interval-Tra ffic distribution)[9].It imposes a lighter load on a router than actual short-interval measurement since EMSIT estimates a short-interval tra ffic distribution only with MIB data,which are measured in cycles of a few minutes (Fig.1)[11].It is easy to operate EMSIT because it requires only MIB and SNMP,which are already implemented on routers,and does not require any particularly expensive devices.Unfortunately,however,EMSIT performance deterio-rates under conditions where the network tra ffic has a long-term-tra ffic dynamics [12].We define long-term-tra ffic dy-namics (such as the tra ffic dynamics during a few minutes)as fluctuations of average tra ffic volumes over a period of a few hours.The change of tra ffic at daytime and night is the one example.Moreover,in the long-term-tra ffic dynamics,there exists average tra ffic volume between “an estimation section †”(term to be estimated such as 20min)and “a mea-surement section”(whole measured term)without the esti-mation section.Moreover,when long-term-tra ffic dynamic exists,the di fference of the average tra ffic volume in the es-timation section to that of the measurement section without the estimation section is greater than the threshold β.To overcome the disadvantage of EMSIT,we propose a suitable tra ffic estimation method,called EMSIT-LD (an Es-timating Method of Short-Interval-Tra ffic distribution con-sidering Long-term-tra ffic Dynamics),for long-term-tra ffic dynamics.EMSIT-LD estimates current short-interval-tra ffic distribution using tra ffic trends measured over the pre-vious couple of hours.We think that the required accuracy depends on both the content of these operations and man-agement policy of operators.Thus,in general,it is di fficult to judge whether it is possible to allow the level of error given by EMSIT or EMSIT-LD.In many cases,we believe that EMSIT-LD is better than EMSIT because the amount of required measurement data and the complexity of theirprocedures are the same.2.EMSIT—Basic MethodIn general,there exist parametric and non-parametric ap-proaches to estimate the probability distribution function [13].The parametric approach can easily be applied to es-timate a distribution,though it requires a priori information of the specification of the distribution.The non-parametric approach can estimate without a priori information,though it may require many parameters and it may become di fficult to handle the model.EMSIT (and also EMSIT-LD proposed in this paper)is a parametric approach and the distribution to be estimated is assumed a normal distribution.Next,we review the basic method of EMSIT.The goal is to estimate the distribution of the average tra ffic volume X (1)(n )(n =1,2,···,m 1m 2k )for short interval T (e.g.8sec.).Using SNMP,we obtain historical data on average tra ffic volumes X (m 1)(n )(n =1,2,···,m 2k )during interval m 1T (m 1>0)from MIB on a router.This estimation method,EMSIT,is applied after the server has gathered the tra ffic information from MIB using SNMP.EMSIT procedureStep 1:Calculate sample average ¯x and sample varianceσ2(m 1)of X (m 1)(n ).Step 2:Calculate variance σ2(m 1m 2)of X(m 1m 2)(n ),which is obtained by averaging the original sample X (m 1)(n )in non-overlapping sub-blocks of size m 2.Step 3:Calculate the variance σ2(1)of X (1)(n )usinglog 10σ2(1)=log 10σ2(m 1)·log 10m 1m 2−log 10σ2(m 1m 2)·log 10m 1log 10m 2.(1)Step 4:Set the distribution of X (1)(n )as the normal distri-bution with average ¯x and variance σ2(1).In Step 3,assuming (2)to be available,(1)can be easily derived from (2).σ2(M )=σ2(1)·M−θ(2)where θis a constant and 0<θ≤1.Equation (2)represents the relationship among di fferent tra ffic statistics X (M )(M =1,2,...),and we assume X (M )(n )to be a stationary random process [15],[16].For intervals shorter than RTT,(2)has not been ob-served [18].When Eq.(2)exists and 0<θ<1,process X (1)(n )is called exactly second-order self-similar with Hurst parame-ter H (the value of H gives the degree of self-similarity and is expressed as H =1−θ/2)[14].The most striking fea-ture of self-similarity is that the correlation structures of the process do not degenerate as M →∞,unlike those of the†“Estimation section”and “measurement section”are de-scribed in detail in Sect.3.1112IEICE MUN.,VOL.E89–B,NO.4APRIL2006traditional Markovian models(θ=1),which all do.Self-similarity has been observed in traffic measurement in ac-tual networks(e.g.,[15]).Those conventional works mainlyfocused on the existence of self-similarity in traffic or on amethod of calculating H.They showed that Internet traffichas self-similarity and that Eq.(2)empirically exists.In Step4,the traffic distribution of X(1)(n)is assumed tobe a normal distribution because the central limited theoremapplies to the case in which manyflows are multiplexed andindependent of each other.This assumption is particularlyreasonable in backbone links[19].3.EMSIT-LD—Our ProposalThe conventional method,EMSIT,has been used only onsteady traffic conditions.If traffic has long-term dynam-ics,we have no idea what the estimation result with EMSITwill be.This is because EMSIT does not always satisfy(2)when estimating traffic distribution in the long-term-trafficdynamics zone.We demonstrate the unavailability of EM-SIT under the condition of long-term-traffic dynamics in thenext section.In this section,we propose the new estimationmethod EMSIT-LD that takes into account long-term-trafficdynamics.In Fig.2,this method estimates the distribution duringtime interval of the“estimation section”(e.g.20min)usingthe“measurement section”(e.g.2hrs).The time intervalof the estimation section should be determined according tonetwork management policy(e.g.30min),and it is deter-mined by positive integer parameter p.The estimation sec-tion shifts every m1T(from j-th estimation section to j+1-thestimation section).We explain the details of the estimationprocedure as follows.EMSIT-LD procedureStep1:Calculate the varianceσ2(m1)andσ2(m1m2)of the traf-fic X(m1)(n)and X(m1m2)(n)inside the measurement sec-tion[0,m1m2kT](Fig.2).Then,calculate the slope s of the regression line l on the Variance Time Plots(Fig.3).s=log10σ2(m1m2)−log10σ2(m1)log10m2.(3)Step2:Divide the measurement section into p sub-sections,and calculate the averageµi(i=1,2,···,p)of the traffic X(m1)(n)in each sub-section.Next,calcu-late the difference between the maximumµmax and theminimumµmin ofµi.If the difference is smaller thanthe thresholdβ(µmax−µmin≤β),substitute the slope s to u;otherwise,do not,where u is a real number.Step3:Calculate the averageˆµand the varianceˆσ2(m1)of the traffic X(m1)(n)inside the estimation section[(1−1 q )m1m2kT,m1m2kT](Fig.2),where the positive inte-ger q is the divisor of ing the variancelog10ˆσ2(m1)and the slope u,describe the regression lineˆl.The y-intercept ofˆl is our estimation variancelog10ˆσ2(1).Fig.2Measurement and estimation sections in EMSIT-LD,and its repetitive calculationroutines.Fig.3Image of EMSIT-LD estimation process.Step4:Estimate the T-interval traffic distribution as the normal distribution of the averageˆµand the variance ˆσ2(1).Step5:Shift the measurement section to the next position, and repeat the same process[Step1–Step4](Fig.2).Step1calculates slope s of the regression line l for the measurement section just like original the EMSIT.In Step 2,EMSIT-LD divides the measurement section into several sections(such as12sections)using parameter p,and com-pares the traffic averages in each section.The parameter p determines the interval time to calculate the traffic average, and p and q can be determined independently.If the dif-ference between the maximum and minimum average traffic is smaller than the thresholdβ,EMSIT-LD judges that the measurement section is in the steady traffic state and uses u calculated in the current routine.On the other hand,if the difference is larger than the thresholdβ,EMSIT-LD judges that the measurement section is in the dynamic traffic state and uses u in its memory that was calculated in the last pe-riod of steady traffic.Step3estimates the variance of the estimated distribution using slope u,which was calculated in Steps1or2,and Step4specifies the traffic distribution during the estimation section.Step5shifts the estimation section.The measurement section requires some time(such as a couple of hours)because EMSIT(-LD)secures enough sam-ples to draw the regression line l on the Variance Time Plots. In the case where the measurement and estimation sections are2hours and20minutes,respectively,and m1m2T=600 (that is,the10-min variance calculation cycle),the measure-FUKAMI et al.:ESTIMATING METHOD OF SHORT-INTERV AL-TRAFFIC DISTRIBUTION1113 ment section provides12samples,whereas the estimationsection provides only two samples to calculate the varianceσ2(m1m2)of the traffic X(m1m2)(n).To overcome this problem,in Step3,assuming that the regression line l in the mea-surement section and the regression lineˆl in the estimation section have the same trend,we parallel-shift the regression line l in order to draw the regression lineˆl.EMSIT cannot estimate correct traffic distribution when estimating during the long-term-traffic dynamics zone because it does not always satisfy Eq.(2)and cannot provide the correct regression line l.On the other hand,our pro-posed method EMSIT-LD can estimate correct traffic dis-tribution regardless of long-term-traffic dynamics because EMSIT-LD estimates traffic distribution using the past re-gression line l,which has been obtained in the past steady traffic states.The disadvantage of EMSIT and the advantage of EMSIT-LD are confirmed numerically in the next section.4.Simulations4.1Simulation ModelFigure4outlines our simulation model,on which network conditions are implemented.Simulation models used in our paper are based on models in conventional studies[20],[21]. There are150clients at the ends of the network,and each client has its own access link.We use ns-2as the network simulator,and evaluate EMSIT and EMSIT-LD in the cases below.Simulation1(S1):Each client requests100-kbytefiles on average,which are represented by an exponential dis-tribution.Traffic volume increases after150min have passed.Figure5illustrates traffic volume per1-minFig.4Simulationmodel.Fig.5Traffic volume(S1).cycle.Simulation2(S2):Each client requests100-kbytefiles on average,which are represented by a Pareto distribu-tion(shape parameter is set to1.5)[22].Traffic vol-ume increases after180min have passed.Figure8il-lustrates traffic volume per1-min cycle.Simulation3(S3):Each client requests100-kbytefiles on average,which are represented by an exponential dis-tribution.Traffic volume increases for a brief period between160min and165min.Figure11illustrates traffic volume per1-min cycle.Simulation4(S4):Each client requests100-kbytefiles on average,which are represented by an exponential dis-tribution.The RTT of half the clients(75clients)is 200ms and the others(75clients)is20ms.Traffic vol-ume increases after160minutes has passed.Figure14 illustrates traffic volume per1-min cycle.Our four models are characterized by distribution of transferredfile size,RTT setting,and tendency for traffic to increase.The two former are used in conventional studies as well,while the latter one is originally introduced in this paper.For the two former ones,these models are set to eval-uate diverse traffic conditions.Thus,individual models have no special meaning for EMSIT and EMSIT-LD.The latter one,however,the tendency for traffic to increase,simulates actual traffic dynamics.In(S1),(S2),(S3),and(S4),tendencies for traffic to in-crease were changed by a change in the average inter-arrival time of the TCP connection for every client.Tendency for traffic to increase in(S1),(S2),and(S4)simulated actual traffic dynamics in the time zone from night to day.The average traffic volume increased every5min,and the aver-age amount of trafficfinally increased by up to six times. Tendency for traffic to increase in(S3)simulated temporal traffic concentration such as a DDoS attack.The average traffic was set to ten times only for a specific5-min interval.The parameters of EMSIT(-LD)are set to T=10,k= 12,m1=6,m2=10,p=12,q=6.The parameterβis set to0.25Mbps(the value was determined in trial experi-ment).These parameters indicate that our estimating target is traffic behavior during a10sec period(T=10),the mea-surement section is2hrs(7,200sec:m1m2kT=7,200),and the estimation section is20min(q=6).The value of short interval T value was determined because second-order qual-ity is significant for many applications.Parameter m1was set based on a general MIB polling interval,and Parameter q was set as a least number to calculate variance for traffic data obtained from MIB during an estimation section.For parameters m2and k,we set these values based on results of the trial experiments,and we confirmed that their values did not strongly influence the performance of EMSIT-LD.Fur-thermore,EMSIT(-LD)obtains the MIB data every1min (m1T=60)and calculates the variance during1-min and 10-min intervals(m1T=60,m1m2T=600).The differ-ence of the average traffic volumes in the12sub-sections (p=12)in the measurement section informs us whether or1114IEICE MUN.,VOL.E89–B,NO.4APRIL2006Fig.6Variance dynamics(S1).Fig.7Comparison of each distribution (S1at 185min).Fig.8Tra ffic volume (S2).not long-term tra ffic dynamics would occur.4.2Simulation ResultWe compare the performances of EMSIT and EMSIT-LD in the (S1)–(S4)situations we mentioned above.Figures 6,9,12and 15illustrate the actual (loga-rithm)variance dynamics calculated by measured data and the those estimated by each estimating method,around the long-term-tra ffic dynamics zone in each simulation.In the conventional method EMSIT,we regard the estimated vari-ances inside the whole measurement section as the one in the estimation section in Fig.2,because EMSIT doesnot Fig.9Variance dynamics(S2).Fig.10Comparison of each distribution (S2at 195min).Fig.11Tra ffic volume (S3).define its estimation section.In those figures,estimated variances by EMSIT-LD fol-low actual variances,though estimated ones by EMSIT do not do so in the long-term-tra ffic dynamics zone.Particu-larly,in Fig.12,estimated variances by EMSIT-LD also fol-low actual variances;however,EMSIT continuously outputs irrelevant variances as long as several-hundred minutes.Figures 6,9,and 15show that accuracies of the esti-mated variances by EMSIT-LD are essentially similar.That is,distribution types of file size and the di fference of RTT do not a ffect the performance of EMSIT(-LD).Moreover,these figures show that estimated variances by EMSIT are smaller than those by EMSIT-LD during period when tra ffic trendsFUKAMI et al.:ESTIMATING METHOD OF SHORT-INTERV AL-TRAFFIC DISTRIBUTION1115Fig.12Variance dynamics(S3).Fig.13Comparison of each distribution (S3at 200min).to increase.This is because the long-term dynamics is rel-atively larger than short-term dynamics and that the slope u of the regression line in EMSIT becomes small.From the viewpoint of network performance management,high traf-fic probability may be underestimated in period when tra ffic trends to increase,thus EMSIT-LD is superior to EMSIT.Figures 7,10,13and 16illustrate the actual tra ffic dis-tribution and distributions calculated by each estimated vari-ance and measured average,where they are calculated at the 185-min (S1),195-min (S2),200-min (S3)and 180-min (S4)marks.In those figures,the estimated tra ffic distribu-tion by EMSIT-LD closely estimates the actual one,particu-larly at higher throughputs.On the other hand,the estimated tra ffic distribution by EMSIT is widely separated from the actual one,particularly in Fig.13.Figure 12shows that estimated variances by EMSIT did not follow actual variances in the case of temporal traf-fic increasing.This is because EMSIT uses all the measured data during a measurement section to estimate variance σ2.Both temporal tra ffic dynamics and the measurement sec-tion’s length a ffect the estimated variance for a long time.On the other hand,EMSIT-LD uses all the measured data during the measurement section only to calculate the slope u of the regression line l .Therefore,temporal tra ffic dy-namics a ffects the estimated variance only for the estimationsection.Fig.14Tra ffic volume(S4).Fig.15Variance dynamics(S4).Fig.16Comparison of each distribution (S4at 180min).5.Numerical ExamplesWe compare performances of EMSIT and EMSIT-LD with actual measured tra ffic data.The measured link was used as the main external connection line (6Mbps)between the LANs in the R&D center of a certain company and the Inter-net.Applications used in the link consist of mainly WWW,e-mail,and FTP.P2P applications were not used.More-over,the LANs comprised more than a thousand PCs.The measurements were conducted for downlink from the Inter-net during the daytime on a weekday.The daytime tra ffic increased in the morning and decreased in the evening.1116IEICE MUN.,VOL.E89–B,NO.4APRIL2006Fig.17Tra fficvolume.Fig.18Variance dynamics.Figure 17illustrates the measured tra ffic volume per 1-min.In Fig.17,the tra ffic has a light load from 0min to 500min,then a heavy load after 500min.We set estimation parameters as follows,T =10,k =12,m 1=6,m 2=10,p =12,q =6.These parameters are same as the simulation ones we evaluated above.Figure 18illustrates estimated and measured (loga-rithm)variance dynamics,where each point is sampled in a 20-min cycle.Estimated variances by EMSIT-LD follow the dynamics of measured variances;however,estimated vari-ances by EMSIT do not follow them.Figures 19and 20illustrate comparisons of estimated and measured distributions at the 515-min and the 920-min marks in Fig.17.The 515-min mark is in the midst of the tra ffic dynamics,while the 920-min mark is in steady traf-fic after the tra ffic dynamics.In Fig.19,only EMSIT pro-duces a dissimilar distribution to the measured one.On the other hand,in Fig.20,both methods produce similar distri-butions to the measured one except for the range between 2and 3Mbps.These results (including the simulation ones)indicate that EMSIT estimates incorrect distributions in the tra ffic dynamics zone and possible distributions after the tra ffic dy-namics zone,whereas EMSIT-LD always estimates almost-correct ones regardless of tra ffic dynamics.Next,we evaluate the performance of the proposed method under various values of threshold parameter βin Step 2of EMSIT-LD,because parameter’s setting mayaf-Fig.19Comparison of each distribution (at 515min).Fig.20Comparison of each distribution (at 920min).Fig.21Threshold βand error ratio.fect the accuracy of the proposed method.Here,we define the error ratio R e as follows,R e ≡ˆσ2(1)−σ2(1) σ2(1),(4)where σ2(1)is an actual tra ffic variance for interval T ,andˆσ2(1)is an estimated variance for T .Figure 21shows error ratios when βwas varied in the case of Fig.17.Each error ratio in this figure is the aver-age error ratio for the whole estimation section.This result shows that the presence of an appropriate βvalue and a smallFUKAMI et al.:ESTIMATING METHOD OF SHORT-INTERV AL-TRAFFIC DISTRIBUTION1117βvalue does not lead to accurate estimation.Figure21shows that the optimal value of the thresh-oldβexists near0.8Mbps for that case.Whenβis smaller than the optimal value,the error ratio greatly deteriorates. In many these cases,“a long-term-traffic dynamics”was de-tected and past traffic measurement data were used to esti-mate the distribution.On the other hand,whenβis larger than the optimal value,the error ratio deteriorates only a lit-tle.We propose an approach to determineβby using actual short-interval measurement data for each link.For example, we measure short-interval measurement data only for one day,and set the parameterβusing these data for after that. We can measure actual short-interval measurement data for many links by equipping a different link with the same de-vice every day.In this approach,probe devices for every link in the wide-area network to measure short-interval data are not necessary,and we can determine value of the parameter βusing only a small number of probe devises.6.ConclusionWe proposed an estimation method of short-interval-traffic distributions considering long-term-traffic dynamics (EMSIT-LD)for QoS network management of multime-dia applications.This method estimates the current short-interval traffic distribution using traffic trends of the pre-vious several hours,which are obtained from the previ-ous steady traffic states.EMSIT-LD enables us to esti-mate the traffic distribution in a long-term-traffic dynamics zone,which was impossible for the conventional estimat-ing method,EMSIT.According to some of the simulation result and numerical examples,the EMSIT-LD successfully demonstrated its performance.Some research problems remain concerning the pro-posed method.The parameter-setting method should be dis-cussed more deeply.EMSIT-LD requires some parameters such as q,βand so on.Furthermore,the value of T and an interval time for the estimation section depend on the network management policy.We should discuss this pol-icy from the perspective of application-level quality.On the other hand,βand q may be not related to the policy,there-fore,we also need to examine a parameter-setting method from the viewpoint of estimation performance.We think investigating using actual traffic data for parameter setting will be useful.Moreover,EMSIT-LD should be evaluated under various network and traffic conditions.To improve the EMSIT-LD,we need to investigate how to integrate it with other statistical methods such as time-series analysis.AcknowledgementThis work was partly supported by a Grant-in-Aid from the 21st Century COE Program(Grant No.14213201)of the Ministry of Education,Culture,Sports,Science and Tech-nology(MEXT),Japan and a Grant-in-Aid for Scientific Research(C)(no.15560327)from the Japan Society for the Promotion of Science(JSPS).References[1]IPPM WG,/,2004.[2]CAIDA,/home/,2004.[3] A.Feldmann,A.Greenberg,C.Lund,N.Reingold,and J.Rexford,“NetScope:Traffic engineering for IP networks,”IEEE Commun.Mag.,vol.14,no.2,pp.11–19,2000.[4]Network Monitoring Tools,/˜cottrell/tcom/nmtf-tools.html,2004.[5]W.Stallings,SNMP,SNMPv2,and RMON practical network man-agement,Second ed.,Addison-Wesley Publishing Company,1996.[6]Agilent Technologies,/,2004.[7]MRTG,/mrtg.html,2005.[8]OpenView,/,2005.[9]T.Asaka,“Method of estimating short-interval-traffic distributionusing MIB,”IEICE mun.,vol.E85-B,no.5,pp.1038–1041,May2002.[10]Y.Breitbart, C.Y.Chan,M.Garofalakis,R.Rastogi,andA.Silberschatz,“Efficiently monitoring bandwidth and la-tency in IP networks,”IEEE INFOCOM2001,/user/minos/Abstracts/infocom01-abs.html,2001.[11]S.Belenki and S.Tafvelin,“Analysis of errors in network load mea-surements,”Computer Communication Review,vol.12,no.1,pp.64–79,2000.[12]T.Fukami,T.Asaka,and T.Takahashi,“Method of estimating short-interval-traffic distribution considered long-term-trafficfluctuation,”IEICE Technical Reports,NS2003–42,June2003.[13] D.S.Moore,The Basic Practice of Statistics,W H Freeman&Co(Sd),2003.[14]Z.Sahinoglu and S.Tekinay,“On multimedia networks:Self-similartraffic and network performance,”IEEE Commun.Mag.,vol.13, no.1,pp.48–52,1999.[15]M.Grossglauser and J.-C.Bolot,“On the relevance of long-rangedependence in network traffic,”IEEE/ACM w.,vol.7, no.5,pp.629–640,2000.[16]M.Roughan,D.Veitch,and P.Abry,“Real-time estimation of theparameters of long-range dependence,”IEEE/ACM w., vol.8,no.4,pp.467–478,2000.[17]H.Furuya,T.Hill,and H.Nakamura,“Influence of transmissiondelay on self-similar scaling behavior of aggregated TCP/IP traffic,”IEICE Technical Reports,SSE2000-10,April2000.[18] A.Feldmann,A.C.Gilbert,and W.Willinger,“Data networks as cas-cades:Investigating the multifractal nature of Internet W AN traffic,”ACM SIGCOMM’98,pp.25–38,Aug.2000.[19]R.Morris and D.Lin,“Variance of aggregated Web traffic,”IEEEINFOCOM2000,pp.360–366,March2000.[20]R.Kawahara,K.Ishibashi,T.Asaka,and K.Ori,“A method of IPtraffic management using the relationship between TCPflow behav-ior and link utilization,”IEICE mun.,vol.E86-B,no.11, pp.3244–3256,Nov.2003.[21]M.Ishizuka,M.Aida,and S.Kuribayashi,“Measurement-basedevaluation of TCP throughput,”IEICE mun.,vol.E87-B, no.12,pp.3637–3649,Dec.2004.[22]M.Nabe,M.Murata,and H.Miyahara,“Analysis and modeling ofWorld Wide Web traffic for cap acity dimensioning of Internet access links,”Performance evaluation,vol.34,no.4,pp.249–271,1998.。