Traffic Prediction for Reliable and Resilient Video Communications Over Multi-Location WMNs

This paper studies reliable and resilient deployment of video over IP across a multi-location organization, where a number of wireless mesh network (WMN) clouds are connected by a virtual private network (VPN). Particularly, we propose a scheme of enhanced SIP proxy server which can support an accountable network. In our proposed solution, the enhanced SIP proxy server consists of three modules, namely traffic load prediction, VPN bandwidth negotiation, and call admission control (CAC) in order to provide trustable service. We identify traffic load prediction as the key component among the three modules, and we further develop a linear predictor of variable sampling rate-normalized least mean square (VSR-NLMS) to estimate the traffic patterns. VSR-NLMS predictor employs adjustable sampling rate to achieve improved efficiency and performance. Numerical results show that our proposed scheme can automatically choose suitable sampling rate to track and predict the traffic load curve with acceptable accuracy and reasonable computational complexity.     

基于数据流管理平台的网络安全事件监控系统

复杂而繁多的网络攻击要求监控系统能够在高速网络流量下实时检测发现各种安全事件．数据流管理系统是一种对高速、大流量数据的查询请求进行实时响应的流数据库模型．本文提出了一种将数据流技术应用到网络安全事件监控中的框架模型．在这个模型中，数据流管理平台有效地支持了对高速网络数据流的实时查询与分析，从而保证基于其上的网络安全事件监控系统能够达到较高的处理性能．利用CQL作为接口语言，精确描述安全事件规则与各种监拉查询，具有很强的灵活性与完整性．另外，系统能够整合入侵检测、蠕虫发现、网络交通流量管理等多种监控功能，具有良好的可扩展性，     

Online querying of d-dimensional hierarchies

In this paper we describe a distributed system designed to efficiently store, query and update multidimensional data organized into concept hierarchies and dispersed over a network. Our system employs an adaptive scheme that automatically adjusts the level of indexing according to the granularity of the incoming queries, without assuming any prior knowledge of the workload. Efficient roll-up and drill-down operations take place in order to maximize the performance by minimizing query flooding. Updates are performed on-line, with minimal communication overhead, depending on the level of consistency needed. Extensive experimental evaluation shows that, on top of the advantages that a distributed storage offers, our method answers the vast majority of incoming queries, both point and aggregate ones, without flooding the network and without causing significant storage or load imbalance. Our scheme proves to be especially efficient in cases of skewed workloads, even when these change dynamically with time. At the same time, it manages to preserve the hierarchical nature of data. To the best of our knowledge, this is the first attempt towards the support of concept hierarchies in DHTs.     

Web search results caching service for structured P2P networks

This paper proposes a two-level P2P caching strategy for Web search queries. The design is suitable for a fully distributed service platform based on managed peer boxes (set-top-box or DSL/cable modem) located at the edge of the network, where both boxes and access bandwidth to those boxes are controlled and managed by an ISP provider. Our solution significantly reduces user query traffic going outside of the ISP provider to get query results from the respective Web search engine. Web users are usually very reactive to worldwide events which cause highly dynamic query traffic patterns leading to load imbalance across peers. Our solution contains a strategy to quickly ease imbalance on peers and spread communication flow among participating peers. Each peer maintains a local result cache used to keep the answers for queries originated in the peer itself and queries for which the peer is responsible for by contacting the Web search engine on-demand. When query traffic is predominantly routed to a few responsible peers our strategy replicates the role of “being responsible for” to neighboring peers so that they can absorb query traffic. This is a fairly slow and adaptive process that we call mid-term load balancing. To achieve a short-term fair distribution of queries we introduce a location cache in each peer which keeps pointers to peers that have already requested the same queries in the recent past. This lets these peers share their query answers with newly requesting peers. This process is fast as these popular queries are usually cached in the first DHT hop of a requesting peer which quickly tends to redistribute load among more and more peers.     

An intelligent optimization-based traffic information acquirement approach to software-defined networking

Internet of things (IoT) is a global information infrastructure that supports access to thousands of monitoring devices and user terminals. A large amount of monitoring data generated by IoT is integrated to cloud computing through the network to improve the quality of life of citizens. Fine-grained and accurate traffic information is important for IoT network management. Software-defined networking (SDN) is a centralized control plane as a logical control center, making network management more flexible and efficient. Then, we collect fine-grained traffic information in SDN-based IoT networks to improve network management. To acquire the traffic information with low overhead and high accuracy, first, we collect the statistics of coarse-grained traffic of flows and fine-grained traffic of links, and then we utilize the intelligent optimization methods to estimate the network traffic. To improve the granularity and accuracy of the acquired traffic information, we construct an optimization function with constraints to decrease the estimation errors. As the optimization function of traffic information is a non-deterministic polynomial-hard problem, we present a heuristic algorithm to obtain the optimal solution of the fine-grained measurement. Finally, we conduct some simulations to verify the proposed measurement scheme. Simulation results show that our approach can improve the granularity and accuracy of traffic information with intelligent optimization methods.     

A New Storage Scheme for Approximate Location Queries in Object-Tracking Sensor Networks

Energy efficiency is one of the most critical issues in the design of wireless sensor networks. Observing that many sensor applications for object tracking can tolerate a certain degree of imprecision in the location data of tracked objects, this paper studies precision-constrained approximate queries that trade answer precision for energy efficiency. We develop an energy-conserving approximate storage (EASE) scheme to efficiently answer approximate location queries by keeping error-bounded imprecise location data at some designated storage node. The data impreciseness is captured by a system parameter called the approximation radius. We derive the optimal setting of the approximation radius for our storage scheme based on the mobility pattern and devise an adaptive algorithm to adjust the setting when the mobility pattern is not available a priori or is dynamically changing. Simulation experiments are conducted to validate our theoretical analysis of the optimal approximation setting. The simulation results show that the proposed EASE scheme reduces the network traffic from a conventional approach by up to 96 percent and, in most cases, prolongs the network lifetime by a factor of 2-5.     

Load characterization and anomaly detection for voice over IP traffic

We consider the problem of traffic anomaly detection in IP networks. Traffic anomalies typically arise when there is focused overload or when a network element fails and it is desired to infer these purely from the measured traffic. We derive new general formulae for the variance of the cumulative traffic over a fixed time interval and show how the derived analytical expression simplifies for the case of voice over IP traffic, the focus of this paper. To detect load anomalies, we show it is sufficient to consider cumulative traffic over relatively long intervals such as 5 min. We also propose simple anomaly detection tests including detection of over/underload. This approach substantially extends the current practice in IP network management where only the first-order statistics and fixed thresholds are used to identify abnormal behavior. We conclude with the application of the scheme to field data from an operational network.     

Resource discovery and request-redirection for dynamic load sharing in multi-provider peering content delivery networks

A constellation of Content Delivery Networks (CDNs), termed as peering CDNs, endeavors to guarantee adequate delivery performance when the incoming request load is overwhelming for a single provider alone. Each user is served by an optimal Web server in terms of network cost, even under heavy load conditions. Before it could be comprehended, appropriate resource discovery and request-redirection mechanisms, coupled with an optimal server selection strategy, should be in place to perform the distribution of highly skewed loads. In this paper, we devise an effective load distribution strategy by adopting distributed resource discovery and dynamic request-redirection mechanisms, taking traffic load and network proximity into account. The load distribution strategy reacts to overload conditions, at a time instance, in any primary CDN server(s) and instantly distributes loads to the target servers, minimizing network cost and observing practical constraints. In this context, we exercise an asynchronous resource discovery protocol, reminiscent of the public/subscribe notion, and formulate the resulting redirection scheme. Extensive simulation analyses demonstrate the novelty of our approach. In particular, we show that our approach is effective to handle high load skews by preserving locality, and thus achieve service “responsiveness”. We also perform a sensitivity analysis to reveal that our redirection scheme outperforms other alternatives to handle peak loads.     

基于滑动窗口的数据流连接聚集查询降载策略

基于单个数据流的滑动窗口聚集查询降载技术和数据流连接技术,提出滑动窗口模型下的数据流连接聚集查询降载策略,给出判断系统是否过载的负载方程和使过载系统恢复到轻载状态的降载算法,使降载后的查询结果同时拥有较小的相对误差和最大的元组输出率。实验结果表明,该降载策略具有较好的可行性和适应性。     

Avoiding class warfare: managing continuous queries with differentiated classes of service

Data stream management systems (DSMSs) offer the most effective solution for processing data streams by efficiently executing continuous queries (CQs) over the incoming data. CQs inherently have different levels of criticality and hence different levels of expected quality of service (QoS) and quality of data (QoD). Adhering to such expected QoS/QoD metrics is even more important in cases of multi-tenant data stream management services. In this work, we propose DILoS, a framework that, through priority-based scheduling and load shedding, supports differentiated QoS and QoD for multiple classes of CQs. Unlike existing works that consider scheduling and load shedding separately, DILoS is a novel unified framework that exploits the synergy between scheduling and load shedding. We also propose ALoMa, a general, adaptive load manager that DILoS is built upon. By its design, ALoMa performs better than the state-of-the-art alternatives in three dimensions: (1) it automatically tunes the headroom factor, (2) it honors the delay target, (3) it is applicable to complex query networks with shared operators. We implemented DILoS and ALoMa in our real DSMS prototype system (AQSIOS) and evaluate their performance for a variety of real and synthetic workloads. Our experimental evaluation of ALoMa verified its clear superiority over the state-of-the-art approaches. Our experimental evaluation of the DILoS framework showed that it (a) allows the scheduler and load shedder to consistently honor CQs’ priorities, (b) significantly increases system capacity utilization by exploiting batch processing, and (c) enables operator sharing among query classes of different priorities while avoiding priority inversion, i.e., a lower-priority class never blocks a higher-priority one.     

基于super-peer的连续查询策略

连续查询是能够执行较长的一段时间、用来监视底层的数据流语义来触发用户定义的行为的查询,它将被动的网络结构转换成主动的网络结构,在大量数据被频繁地远程更新的分布式网络环境中特别有用.目前,连续查询领域已经成为倍受关注的P2P应用环境.现有P2P连续查询系统存在一定缺陷,作者提出一种基于super-peer的连续查询策略进行相似查询聚簇来减少重复操作,并提出相应的负载平衡算法对查询聚簇进行微调, 改善连续查询网络的负载平衡.该策略能有效地避免洪泛整个网络,具有很好的可扩展性;它不限制系统动态性,不易产生瓶颈,能在尽量少地影响查询聚簇的情况下,改善连续查询网络的负载平衡.     

Collection trees for event-monitoring queries

In this paper we present algorithms for building and maintaining efficient collection trees that provide the conduit to disseminate data required for processing monitoring queries in a wireless sensor network. While prior techniques base their operation on the assumption that the sensor nodes that collect data relevant to a specified query need to include their measurements in the query result at every query epoch, in many event monitoring applications such an assumption is not valid. We introduce and formalize the notion of event monitoring queries and demonstrate that they can capture a large class of monitoring applications. We then show techniques which, using a small set of intuitive statistics, can compute collection trees that minimize important resources such as the number of messages exchanged among the nodes or the overall energy consumption. Our experiments demonstrate that our techniques can organize the data collection process while utilizing significantly lower resources than prior approaches.     

Efficient packet sampling for accurate traffic measurements

Packet sampling is needed to measure network traffic scalably at high speeds. While many sampled-based measurement techniques have been developed in the recent past, most approaches select packets uniformly, without regard to their size. We discuss that this behavior can negatively impact the performance of tools, and present a sampling scheme that, taking into account packet sizes, overcomes several weaknesses of classic sampling methods. While the idea behind of our approach is conceptually not new, the way we propose to implement it yields a cost-effective solution that is suitable at very high speeds.To see the advantages of the approach, we study the problem of estimating traffic volumes. Our analysis and experimental evaluation with real traffic traces show that sampling considering packet sizes can improve the quality of measurements and make their accuracy less dependant on the properties of the traffic, at a small additional overhead compared to traditional methods.     

Optimization Techniques for Reactive Network Monitoring

We develop a framework for minimizing the communication overhead of monitoring global system parameters in IP networks and sensor networks. A global system predicate is defined as a conjunction of the local properties of different network elements. A typical example is to identify the time windows when the outbound traffic from each network element exceeds a predefined threshold. Our main idea is to optimize the scheduling of local event reporting across network elements for a given network traffic load and local event frequencies. The system architecture consists of N distributed network elements coordinated by a central monitoring station. Each network element monitors a set of local properties and the central station is responsible for identifying the status of global parameters registered in the system. We design an optimal algorithm, the Partition and Rank (PAR) scheme, when the local events are independent; whereas, when they are dependent, we show that the problem is NP-complete and develop two efficient heuristics: the PAR for dependent events (PAR-D) and Adaptive (Ada) algorithms, which adapt well to changing network conditions, and outperform the current state of the art techniques in terms of communication cost.     

Flexible Deterministic Packet Marking: An IP Traceback System to Find the Real Source of Attacks

IP traceback is the enabling technology to control Internet crime. In this paper we present a novel and practical IP traceback system called Flexible Deterministic Packet Marking (FDPM) which provides a defense system with the ability to find out the real sources of attacking packets that traverse through the network. While a number of other traceback schemes exist, FDPM provides innovative features to trace the source of IP packets and can obtain better tracing capability than others. In particular, FDPM adopts a flexible mark length strategy to make it compatible to different network environments; it also adaptively changes its marking rate according to the load of the participating router by a flexible flow-based marking scheme. Evaluations on both simulation and real system implementation demonstrate that FDPM requires a moderately small number of packets to complete the traceback process; add little additional load to routers and can trace a large number of sources in one traceback process with low false positive rates. The built-in overload prevention mechanism makes this system capable of achieving a satisfactory traceback result even when the router is heavily loaded. It has been used to not only trace DDoS attacking packets but also enhance filtering attacking traffic.     

数据流滑动窗口聚集查询降载策略研究*

滑动窗口聚集查询在数据流管理系统中应用广泛,数据流到达高峰期,必须考虑滑动窗口聚集查询中出现的降载问题。分析了子集模型的特点和已有降载策略的不足,给出了数据流滑动窗口聚集查询降载问题的约束条件,提出了能保证子集结果产生的基于丢弃窗口更新策略的降载算法。理论分析和实验结果表明,该算法对数据流滑动窗口聚集查询降载问题的处理具有较高的有效性和实用性。     

Adaptive Fault Monitoring in All-Optical Networks Utilizing Real-Time Data Traffic

We propose a novel fault detection and localization scheme for all-optical networks with the information of real-time data traffic. Our adaptive fault localization framework is based on combining passive and proactive monitoring solutions, together with adaptive management in two phases. Numerical results indicate that our proposed scheme has good scalability, in terms of the number of fault monitors required. Also, we show that our framework allows more flexible network design, and requires much less monitoring bandwidth when compared with the passive monitoring solutions.     

Path prediction and predictive range querying in road network databases

In automotive applications, movement-path prediction enables the delivery of predictive and relevant services to drivers, e.g., reporting traffic conditions and gas stations along the route ahead. Path prediction also enables better results of predictive range queries and reduces the location update frequency in vehicle tracking while preserving accuracy. Existing moving-object location prediction techniques in spatial-network settings largely target short-term prediction that does not extend beyond the next road junction. To go beyond short-term prediction, we formulate a network mobility model that offers a concise representation of mobility statistics extracted from massive collections of historical object trajectories. The model aims to capture the turning patterns at junctions and the travel speeds on road segments at the level of individual objects. Based on the mobility model, we present a maximum likelihood and a greedy algorithm for predicting the travel path of an object (for a time duration h into the future). We also present a novel and efficient server-side indexing scheme that supports predictive range queries on the mobility statistics of the objects. Empirical studies with real data suggest that our proposals are effective and efficient.     

Mean–variance relationship of the number of flows in traffic aggregation and its application to traffic management

We consider the mean–variance relationship of the number of flows in traffic aggregation, where flows are divided into several groups randomly, based on a predefined flow aggregation index, such as source IP address. We first derive a quadratic relationship between the mean and the variance of the number of flows belonging to a randomly chosen traffic aggregation group. Note here that the result is applicable to sampled flows obtained through packet sampling. We then show that our analytically derived mean–variance relationship fits well those in actual packet trace data sets. Next, we present two applications of the mean–variance relationship to traffic management. One is an application to detecting network anomalies through monitoring a time series of traffic. Using the mean–variance relationship, we determine the traffic aggregation level in traffic monitoring so that it meets two predefined requirements on false positive and false negative ratios simultaneously. The other is an application to load balancing among network equipments that require per-flow management. We utilize the mean–variance relationship for estimating the processing capability required in each network equipment.