Inverting Sampled Traffic

1
Inverting Sampled Traffic

• Nicolas Hohn, Darryl Veitch
• Presented by guanghui He

2
Outline

• Introduction and preliminaries
• Objective
• Theoretical analysis
• Practical results
• Conclusion

3
Network measurement

• Proactive methods
• Single probing packet pair techniques
• Packet pair techniques
• Representatives pathchar, pathload, delphi,
  pathchirp
• Passive methods
• Network sampling packet level sampling and flow
  level sampling

4
Sampling techniques

• Simple random sampling method each incoming
  packet is sampled with prob. P
• Systematic sampling
• Stratified random sampling

T
5
Two level of sampling in Internet traffic

• Packet level without considering which flow a
  packet belongs to. Usually used to the measure
  the volume of traffic (first order statistics)
• Flow level sample the packets within a
  particular flow. Usually used to find more
  complicated statistics, i.e., the distribution of
  packets within a flow, and can be used to further
  identify elephants and mice.
• Sometimes, these two techniques are combined

6
Objective of this paper

• How to obtain the spectral density (packet level)
  of the traffic, which is second order statistics.
• How to obtain the distribution of the number of
  packets per flow (flow level).
• Sampling method packet sampling and flow
  sampling
• In each sampling method, simple random sampling
  technique is applied.

7
Theoretical analysis

• Theoretically, how to obtain power spectral
  density and the distribution of the number of
  packets per flow from packet sampling and flow
  sampling?
• Notations for a stationary point process X with
  rate , each point of X is kept with prob. q,
  so that the sampled process is a new point
  process
• with rate . Let
  and denote the spectral density of
  the thinned and original process respectively.

8
Packet sampling

• Existing result reads
• so with the knowledge of ,
  can be easily obtained.
• To derive the distribution of the number of
  packets in each flow assume the original process
  is the superposition of identically distributed
  groups of points call clusters (flows). Let P
  denote the discrete random variable representing
  the number of points in each cluster with density
  , distribution ,
  mean

9
Packet sampling (cont.)

• Similar notations with superscript (q) denotes
  those for the thinned point process.
• Then, it is straightforward to get
• Let C(z,r), D(z,r) and denote the
  circle, the open disk and the full disk with
  center z and radius r. Let B be the binomial
  random variable with parameter q. Let
  be the prob. generating
  function of P, and B

10
Packet sampling (cont.)

• Then we have
  or,
• and
• Theoretically, the probability of can be
  obtained by picking out the coefficients of a
  power series expansion of Gp about the origin.
  But what we get is not defined over the entire
  disk.
• How to recover the original probability
  densities?

11
How to recover?
12
Analytical continuation

• In principle, Gp is analytical in D(0,1) and we
  know its values on D(1-q,q) which lies inside
  D(0,1), then Gp is know on D(0,1) through
  analytic continuation.
• Denote and ,
  then
• Choose a point and to expend Gp as
  a power series about it and the coefficient of
  the new series can be obtained as

13
Analytical continuation (cont.)

• The coefficient of the new series
• Consider the case in the previous figure choose
  , we have and
• Now it works fine for , what if
  qlt0.5?

14
Analytic continuation (cont.)

• A recursive procedure involving a sequence
• At the kth stage, is chosen to lie inside the
  circle of convergence from the previous step, and
  Gp will be expanded in a power series centered
  about , and the coefficients can be obtained
  from previous stage

15
An illustration
16
The second method

• Inverse transform based method given Gp(z), we
  can use Cauchy integral formula, where s is
  closed contour containing origin.
• The problem is such kind of closed contour may
  not exist. A common method is to use Pade
  approximation.

17
Flow sampling

• The flow sampling consists in selecting flows
  with probability q.
• Since the flows are kept by the thinning
  procedure are identically the same as the
  original flow, there is no inversion problem for
  the distribution of the number of packet per
  flow.
• How to get the spectral density of the original
  process?

18
Flow sampling (cont.)

• Consider a special kind of stationary point
  process X(t). Let the arrival times of
  flows follow a given process Y(t) of rate .
  Then the cluster process X(t) is defined as
  , where
  represents the arrival process of packets within
  flow i.
• Furthermore, Y(t) is assumed to be Poisson and
  all flows are mutually independent.

19
Flow sampling (cont.)

• Let be the spectrum of , the
  spectrum of X(t) can be shown to be
• The i.i.d sampling with probability q of the
  Poisson flow arrival process Y(t) with rate
  is also a Poisson process with rate
• .
• So
  , and

20
Practical results spectral
21
Practical resultspectral (2)
22
Flow distribution (1)
23
Flow distribution (2)
24
Conclusions

• Packet sampling leads to an excellent
  reconstruction of the spectrum and a fair
  estimate the distribution of the number of packet
  per flow for qgt0.5
• The flow sampling gives a reasonable estimate of
  the spectrum and an excellent estimate of the
  distribution of the number of packet per flow for
  a larger range of thinning probabilities.