Virtual private network bandwidth management with traffic prediction

Dynamic link resizing is an attractive approach for resource management in virtual private networks (VPNs) serving modern real-time and multimedia traffic. In this paper, we assess the use of linear traffic predictors to dynamically resize the bandwidth of VPN links. We present the results of performance comparisons of three predictors: Gaussian, auto-regressive moving average (ARMA) and fractional auto-regressive integrated moving average (fARIMA). The comparisons are based on the mean packet delay, the variance of the packet delay, and the buffer requirements. Guided by our performance tests, we propose and evaluate a new predictor for link resizing: linear predictor with dynamic error compensation (L-PREDEC). Our performance tests show that L-PREDEC works better than Gaussian, ARMA and fARIMA in terms of the three metrics listed above. The benefit of L-PREDEC over the Gaussian predictor is demonstrated in two configurations: a common queue with aggregate link resizing and multiple queues with separate link resizing. In both configurations, L-PREDEC has consistently achieved better multiplexing gain and higher bandwidth utilization than its Gaussian counterpart.     

Two approximation methods to synthesize the power spectrum of fractional Gaussian noise

The simplest models with long-range dependence (LRD) are self-similar processes. Self-similar processes have been formally considered for modeling packet traffic in communication networks. The fractional Gaussian noise (FGN) is a proper example of exactly self-similar processes. Several numeric approximation methods are considered and reviewed, two methods are found that are able to provide a better accuracy and less running time than previous approximation methods for synthesizing the power spectrum of FGN. The first method is based on a second-order approximation. It is demonstrated that a parabolic curve can be indirectly used to approximate the power spectrum of FGN. The second method is based on cubic splines. Despite the fact that splines cannot be used directly to approximate the power spectrum of FGN, they can, however, considerably simplify the calculations while maintaining high accuracy. Both of the methods proposed can be used to estimate the Hurst parameter using Whittle's estimator. Additionally, they can be used on synthesis of LRD sequences.     

Impact of aggregated, self-similar ON/OFF traffic on delay in stationary queueing models (extended version)

The impact of the now widely acknowledged self-similar property of network traffic on cell-delay in a single server queueing model is investigated. The analytic traffic model, called N-Burst, uses the superposition of N independent cell streams of ON/OFF type with power-tail distributed ON periods. Queueing-delay for such arrival processes is mainly caused by over-saturation periods, which occur when too many sources are in their ON-state. The duration of the over-saturation periods is shown to have a power-tail distribution, whose exponent β is in most scenarios different from the tail exponent of the individual ON-period. Conditions on the model parameters, for which the mean and higher moments of the delay distribution become infinite, are investigated. Since these conditions depend on traffic parameters as well as on network parameters, careful network design can alleviate the performance impact of such self-similar traffic. Finally, a characterization of truncated tails by the so-called power-tail range is developed. Based on the power-tail range of the burst-length distribution, the additional parameter maximum burst size (MBS) is introduced in the N-Burst model. An asymptotic relationship between the moments of the delay distribution and the MBS is derived and is validated by the corresponding numerical results of the analytic N-Burst/M/1 queueing model.     

Neural projection techniques for the visual inspection of network traffic

A crucial aspect in network monitoring for security purposes is the visual inspection of the traffic pattern, mainly aimed to provide the network manager with a synthetic and intuitive representation of the current situation. Towards that end, neural projection techniques can map high-dimensional data into a low-dimensional space adaptively, for the user-friendly visualization of monitored network traffic. This work proposes two projection methods, namely, cooperative maximum likelihood Hebbian learning and auto-associative back-propagation networks, for the visual inspection of network traffic. This set of methods may be seen as a complementary tool in network security as it allows the visual inspection and comprehension of the traffic data internal structure. The proposed methods have been evaluated in two complementary and practical network-security scenarios: the on-line processing of network traffic at packet level, and the off-line processing of connection records, e.g. for post-mortem analysis or batch investigation. The empirical verification of the projection methods involved two experimental domains derived from the standard corpora for evaluation of computer network intrusion detection: the MIT Lincoln Laboratory DARPA dataset.     

Prediction and tracking of long-range-dependent sequences

Long-range-dependent (LRD) sequences have been found to be of importance in various fields such as telecommunications, signal processing and finance. Since the history of an LRD sequence has significant impact on the present values, it is expected that accurate prediction and tracking of these sequences are easier than of short-range-dependent sequences. The purpose of this paper is to verify whether distant observations in the past might increase the performance of a constrained tracker significantly when this information from the past is used in combination with recent observations.     

Analysis and modeling of a campus wireless network TCP/IP traffic

In this paper we analyzed and modeled wireless TCP/IP traffic. Specifically, we focused on the interarrival times of TCP flows and the number of packets within a flow. We show that the marginal distribution of the flow interarrival times is piecewise Weibull distributed. Second and higher order statistics show that the flow interarrival times are long-range dependent and exhibit multifractal scaling. Taking these higher order properties into consideration, we proposed a multinomial canonical cascade with 3 stages to model the flow interarrival times. Looking at the IP layer, we find that the number of packets in a flow is heavy-tailed distributed. Especially interesting is that in 2 of our data sets, the number of packets in a flow possesses infinite mean. The interarrival time of packets within a flow is highly correlated, bursty, and its statistical characteristics vary from flow to flow.     

网络流量长相关特性估计算法性能评估

定量刻画网络流量的长相关特性是网络特性研究的重要基础。对当前常用的Hurst指数估计算法进行了详细归纳。在此基础上,以已知Hurst指数的分形高斯噪声(fGn)序列为主要研究对象,利用逆向方法,分别研究了周期信号以及高斯白噪声影响下的Hurst指数估计算法的估计性能。通过比较,发现没有任何一种Hurst指数估计算法能够广泛应用于复杂条件下网络流量序列的Hurst指数的准确估计,其主要原因是因为这些算法的主要思想都是在全域内运用了求和平均的方法,使得流量序列的高可变信息受损,导致估计误差增大。     

The design and evaluation of the Simple Self-Similar Sequences Generator

This paper describes a new algorithm for the generation of pseudo random numbers with approximate self-similar structure. The Simple Self-Similar Sequences Generator (4SG) elaborates on an intuitive approach to obtain a fast and accurate procedure, capable of reproducing series of points exhibiting the property of persistence and anti-persistence. 4SG has a computational complexity of O(n) and memory requirements of the order of log₂(N), where N is the number of points to be generated. The accuracy of the algorithm is evaluated by means of computer-based simulations, recurring to several Hurst parameter estimators, namely Variance Time (VT) and the Wavelets-based estimator. The Hosking and the Wavelets-based methods for the generation of self-similar series were submitted to the same tests the 4SG was analysed with, providing for a basis for comparison of several performance aspects of the algorithm. Results show that the proposal embodies a good candidate not only for on-demand emulation of arbitrarily long self-similar sequences, but also for fast and efficient online simulations.     

一种网络流量预测的小波神经网络模型

结合小波变换和人工神经网络的优势,建立一种网络流量预测的小波神经网络模型。首先对流量时间序列进行小波分解,得到小波变换尺度系数序列和小波系数序列,以系数序列和原来的流量时间序列分别作为模型的输入和输出,构造人工神经网络并且加以训练。用实际网络流量对该模型进行验证,结果表明,该模型具有较高的预测效果。     

基于非线性算法的网络业务流量预测

基于递归最小二乘支持向量机,提出了一种网络业务流量非线性预测算法。通过最小二乘支持量机首先将原始的网络流量数据映射到一个高维空间中,进而在这个高维空间中对流量数据进行预测,使得在低维空间中非线性预测转化为高维空间中的线性预测,提高了预测性能。仿真结果表明,预测误差能够维持在5%以内。