Transcript A Nonstationary Poisson View of Internet Traffic

A Nonstationary Poisson View of
Internet Traffic
T. Karagiannis, M. Molle, M. Faloutsos
University of California, Riverside
A. Broido
University of California, San Diego
IEEE INFOCOM 2004
Presented by Ryan
Outline
• Introduction
• Background
– Definitions
– Previous Models
• Observed Behavior
– A time-dependent Poisson characterization
• Conclusion
Introduction
• Nature of Internet Traffic
– How does Internet traffic look like?
• Modeling of Internet Traffic
– Provisioning
– Resource Management
– Traffic generation in simulation
Introduction
• Comparing with ten years ago
– Three orders of magnitude increase in
• Links speed
• Number of hosts
• Number of flows
– Limiting behavior of an aggregate traffic
flow created by multiplexing large number
of independent flows  Poisson model
Background – Definitions
• Complementary cumulative distribution
function (CCDF)
F (t )  1  F (t )
C
F (t )  e
C
 t
,t  0
exponential distribution
• Autocorrelation Function (ACF)
– Correlation between a time series {Xt} and
its k-shifted time series {Xt+k}
 (k ) 
E [ X t   ]E [ X t  k   ]

2
Background – Definitions
• Long Range Dependence (LRD)
– The sum of its autocorrelation does not
converge


 (k )  
k 1
• Memory is built-in to the process
Background – Definitions
• Self-similarity
– Certain properties are preserved
irrespective of scaling in space or time
X ( at )  a X ( t )
H
• H – Hurst exponent
Background – Definitions
Self-similar
Background – Definitions
• Second-order self-similar
– ACF is preserved irrespective of time
aggregation
lim
k
 (k ) 
1
[( k  1)
2H
 2k
2H
 ( k  1)
2H
2
0 .5  H  1
• Model LRD process
• H  1, the dependence is stronger
]
Background – Previous Model
• Telephone call arrival process (70’s –
80’s)
– Poisson Model
– Independent inter-arrival time
• Internet Traffic (90’s)
– Self-similarity
– Long-range dependence (LRD)
– Heavy tailed distribution
Findings in the Paper
• At Sub-Second Scales
– Poisson and independent packets arrival
• At Multi-Second Scales
– Nonstationary
• At Larger Time Scales
– Long Range Dependence
Traffic Traces
• Traces from CAIDA (primary focus)
– Internet backbone, OC48 link (2.5Gbps)
– August 2002, January and April 2003
• Traces from WIDE
– Trans-Pacific link (100Mbps)
– June 2003
Traffic Traces
• BC-pAug89 and LEL-PKT-4 traces
– On the Self-Similar Nature of Ethernet
Traffic. (1994)
• W. E. Leland, M. S. Taqqu, W. Willinger, and D.
V. Wilson.
– Wide Area Traffic: The Failure of Poisson
Modeling. (1995)
• V. Paxson and S. Floyd.
Traffic Traces
• Analysis of OC48 traces
– The link is overprovisioned
• Below 24% link unilization
– ~90% bytes (TCP)
– ~95% packets (TCP)
Poisson at Sub-Second Time Scales
• Distribution of Packet Inter-arrival Times
– Red line – corresponding to exponential
distribution
– Blue line – OC48 traces
– Linear least squares fitting  99.99% confidence
Poisson at Sub-Second Time Scales
WIDE trace
LBL-PKT-4 trace
Poisson at Sub-Second Time Scales
• Independence
Inter-arrival Time ACF
Packet Size ACF
95% confidence interval of zero
Nonstationary at Multi-Second Time
Scales
• Rate changes at second scales
• Changes detection
– Canny Edge Detector algorithm
change point
Nonstationary at Multi-Second Time
Scales
• Similar in BC-pAug89 trace
Nonstationary at Multi-Second Time
Scales
• Possible causes for nonstationarity
– Variation of the number of active sources
over time
– Self-similarity in the traffic generation
process
– Change of routing
Nonstationary at Multi-Second Time
Scales
• Characteristics of nonstationary
– Magnitude of the rate change events
• Significant negative correlation at lag one
– An increase followed by a decrease
Nonstationary at Multi-Second Time
Scales
– Duration of change free intervals
• Follow the exponential distribution
LRD at Large Time Scales
• Measure LRD by the Hurst exponent (H)
estimators
– LRD, H  1
– Point of Change (Dichotomy in scaling)
• Below ~ 0.6, Above ~ 0.85
Point of Change
LRD at Large Time Scales
• Effect of nonstationarity
– Remove “nonstationarity” by moving
average (Gaussian window)
Point of Change
Conclusion
• Revisit Poisson assumption
– Analyzing a combination of traces
• Different observations at different time
scales
• Network Traffic
– Time-dependent Poisson
• Backbone links only
• Massive scale and multiplexing
– MAY lead to a simpler model
Background – Definitions
• Poisson Process
– The number of arrivals occurring in two disjoint (nonoverlapping) subintervals are independent random
variables.
– The probability of the number of arrivals in some subinterval
[t,t + τ] is given by
– The inter-arrival time is exponentially distributed