A Nonstationary Poisson View of Internet Traffic

1
A Nonstationary Poisson View of Internet Traffic

• T. Karagiannis, M. Molle, M. Faloutsos
• University of California, Riverside
• A. Broido
• University of California, San Diego
• IEEE INFOCOM 2004

Presented by Ryan
2
Outline

• Introduction
• Background
• Definitions
• Previous Models
• Observed Behavior
• A time-dependent Poisson characterization
• Conclusion

3
Introduction

• Nature of Internet Traffic
• How does Internet traffic look like?
• Modeling of Internet Traffic
• Provisioning
• Resource Management
• Traffic generation in simulation

4
Introduction

• Comparing with ten years ago
• Three orders of magnitude increase in
• Links speed
• Number of hosts
• Number of flows
• Limiting behavior of an aggregate traffic flow
  created by multiplexing large number of
  independent flows ? Poisson model

5
Background Definitions

• Complementary cumulative distribution function
  (CCDF)
• Autocorrelation Function (ACF)
• Correlation between a time series Xt and its
  k-shifted time series Xtk

exponential distribution
6
Background Definitions

• Long Range Dependence (LRD)
• The sum of its autocorrelation does not converge
• Memory is built-in to the process

7
Background Definitions

• Self-similarity
• Certain properties are preserved irrespective of
  scaling in space or time
• H Hurst exponent

8
Background Definitions
Self-similar
9
Background Definitions

• Second-order self-similar
• ACF is preserved irrespective of time aggregation
• Model LRD process
• H ? 1, the dependence is stronger

10
Background Previous Model

• Telephone call arrival process (70s 80s)
• Poisson Model
• Independent inter-arrival time
• Internet Traffic (90s)
• Self-similarity
• Long-range dependence (LRD)
• Heavy tailed distribution

11
Findings in the Paper

• At Sub-Second Scales
• Poisson and independent packets arrival
• At Multi-Second Scales
• Nonstationary
• At Larger Time Scales
• Long Range Dependence

12
Traffic Traces

• Traces from CAIDA (primary focus)
• Internet backbone, OC48 link (2.5Gbps)
• August 2002, January and April 2003
• Traces from WIDE
• Trans-Pacific link (100Mbps)
• June 2003

13
Traffic Traces

• BC-pAug89 and LEL-PKT-4 traces
• On the Self-Similar Nature of Ethernet Traffic.
  (1994)
• W. E. Leland, M. S. Taqqu, W. Willinger, and D.
  V. Wilson.
• Wide Area Traffic The Failure of Poisson
  Modeling. (1995)
• V. Paxson and S. Floyd.

14
Traffic Traces

• Analysis of OC48 traces
• The link is overprovisioned
• Below 24 link unilization
• 90 bytes (TCP)
• 95 packets (TCP)

15
Poisson at Sub-Second Time Scales

• Distribution of Packet Inter-arrival Times
• Red line corresponding to exponential
  distribution
• Blue line OC48 traces
• Linear least squares fitting ? 99.99 confidence

16
Poisson at Sub-Second Time Scales
LBL-PKT-4 trace
WIDE trace
17
Poisson at Sub-Second Time Scales

• Independence

18
Nonstationary at Multi-Second Time Scales

• Rate changes at second scales
• Changes detection
• Canny Edge Detector algorithm

change point
19
Nonstationary at Multi-Second Time Scales

• Similar in BC-pAug89 trace

20
Nonstationary at Multi-Second Time Scales

• Possible causes for nonstationarity
• Variation of the number of active sources over
  time
• Self-similarity in the traffic generation process
• Change of routing

21
Nonstationary at Multi-Second Time Scales

• Characteristics of nonstationary
• Magnitude of the rate change events
• Significant negative correlation at lag one
• An increase followed by a decrease

22
Nonstationary at Multi-Second Time Scales

• Duration of change free intervals
• Follow the exponential distribution

23
LRD at Large Time Scales

• Measure LRD by the Hurst exponent (H) estimators
• LRD, H ? 1
• Point of Change (Dichotomy in scaling)
• Below 0.6, Above 0.85

Point of Change
24
LRD at Large Time Scales

• Effect of nonstationarity
• Remove nonstationarity by moving average
  (Gaussian window)

Point of Change
25
Conclusion

• Revisit Poisson assumption
• Analyzing a combination of traces
• Different observations at different time scales
• Network Traffic
• Time-dependent Poisson
• Backbone links only
• Massive scale and multiplexing
• MAY lead to a simpler model

26
Background Definitions

• Poisson Process
• The number of arrivals occurring in two disjoint
  (non-overlapping) subintervals are independent
  random variables.
• The probability of the number of arrivals in some
  subinterval t,t t is given by
• The inter-arrival time is exponentially
  distributed