#### Transcript A Nonstationary Poisson View of Internet Traffic

A Nonstationary Poisson View of Internet Traffic T. Karagiannis, M. Molle, M. Faloutsos University of California, Riverside A. Broido University of California, San Diego IEEE INFOCOM 2004 Presented by Ryan Outline • Introduction • Background – Definitions – Previous Models • Observed Behavior – A time-dependent Poisson characterization • Conclusion Introduction • Nature of Internet Traffic – How does Internet traffic look like? • Modeling of Internet Traffic – Provisioning – Resource Management – Traffic generation in simulation Introduction • Comparing with ten years ago – Three orders of magnitude increase in • Links speed • Number of hosts • Number of flows – Limiting behavior of an aggregate traffic flow created by multiplexing large number of independent flows Poisson model Background – Definitions • Complementary cumulative distribution function (CCDF) F (t ) 1 F (t ) C F (t ) e C t ,t 0 exponential distribution • Autocorrelation Function (ACF) – Correlation between a time series {Xt} and its k-shifted time series {Xt+k} (k ) E [ X t ]E [ X t k ] 2 Background – Definitions • Long Range Dependence (LRD) – The sum of its autocorrelation does not converge (k ) k 1 • Memory is built-in to the process Background – Definitions • Self-similarity – Certain properties are preserved irrespective of scaling in space or time X ( at ) a X ( t ) H • H – Hurst exponent Background – Definitions Self-similar Background – Definitions • Second-order self-similar – ACF is preserved irrespective of time aggregation lim k (k ) 1 [( k 1) 2H 2k 2H ( k 1) 2H 2 0 .5 H 1 • Model LRD process • H 1, the dependence is stronger ] Background – Previous Model • Telephone call arrival process (70’s – 80’s) – Poisson Model – Independent inter-arrival time • Internet Traffic (90’s) – Self-similarity – Long-range dependence (LRD) – Heavy tailed distribution Findings in the Paper • At Sub-Second Scales – Poisson and independent packets arrival • At Multi-Second Scales – Nonstationary • At Larger Time Scales – Long Range Dependence Traffic Traces • Traces from CAIDA (primary focus) – Internet backbone, OC48 link (2.5Gbps) – August 2002, January and April 2003 • Traces from WIDE – Trans-Pacific link (100Mbps) – June 2003 Traffic Traces • BC-pAug89 and LEL-PKT-4 traces – On the Self-Similar Nature of Ethernet Traffic. (1994) • W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson. – Wide Area Traffic: The Failure of Poisson Modeling. (1995) • V. Paxson and S. Floyd. Traffic Traces • Analysis of OC48 traces – The link is overprovisioned • Below 24% link unilization – ~90% bytes (TCP) – ~95% packets (TCP) Poisson at Sub-Second Time Scales • Distribution of Packet Inter-arrival Times – Red line – corresponding to exponential distribution – Blue line – OC48 traces – Linear least squares fitting 99.99% confidence Poisson at Sub-Second Time Scales WIDE trace LBL-PKT-4 trace Poisson at Sub-Second Time Scales • Independence Inter-arrival Time ACF Packet Size ACF 95% confidence interval of zero Nonstationary at Multi-Second Time Scales • Rate changes at second scales • Changes detection – Canny Edge Detector algorithm change point Nonstationary at Multi-Second Time Scales • Similar in BC-pAug89 trace Nonstationary at Multi-Second Time Scales • Possible causes for nonstationarity – Variation of the number of active sources over time – Self-similarity in the traffic generation process – Change of routing Nonstationary at Multi-Second Time Scales • Characteristics of nonstationary – Magnitude of the rate change events • Significant negative correlation at lag one – An increase followed by a decrease Nonstationary at Multi-Second Time Scales – Duration of change free intervals • Follow the exponential distribution LRD at Large Time Scales • Measure LRD by the Hurst exponent (H) estimators – LRD, H 1 – Point of Change (Dichotomy in scaling) • Below ~ 0.6, Above ~ 0.85 Point of Change LRD at Large Time Scales • Effect of nonstationarity – Remove “nonstationarity” by moving average (Gaussian window) Point of Change Conclusion • Revisit Poisson assumption – Analyzing a combination of traces • Different observations at different time scales • Network Traffic – Time-dependent Poisson • Backbone links only • Massive scale and multiplexing – MAY lead to a simpler model Background – Definitions • Poisson Process – The number of arrivals occurring in two disjoint (nonoverlapping) subintervals are independent random variables. – The probability of the number of arrivals in some subinterval [t,t + τ] is given by – The inter-arrival time is exponentially distributed