A Nonstationary Poisson View of Internet Traffic

A Nonstationary Poisson View of Internet Traffic T. Karagiannis, M. Molle, M. Faloutsos University of California, Riverside A. Broido University of California, San Diego IEEE INFOCOM 2004 Presented by Ryan

Outline • Introduction • Background • Definitions • Previous Models • Observed Behavior • A time-dependent Poisson characterization • Conclusion

Introduction • Nature of Internet Traffic • How does Internet traffic look like? • Modeling of Internet Traffic • Provisioning • Resource Management • Traffic generation in simulation

Introduction • Comparing with ten years ago • Three orders of magnitude increase in • Links speed • Number of hosts • Number of flows • Limiting behavior of an aggregate traffic flow created by multiplexing large number of independent flows  Poisson model

Background – Definitions • Complementary cumulative distribution function (CCDF) • Autocorrelation Function (ACF) • Correlation between a time series {Xt} and its k-shifted time series {Xt+k} exponential distribution

Background – Definitions • Long Range Dependence (LRD) • The sum of its autocorrelation does not converge • Memory is built-in to the process

Background – Definitions • Self-similarity • Certain properties are preserved irrespective of scaling in space or time • H – Hurst exponent

Background – Definitions Self-similar

Background – Definitions • Second-order self-similar • ACF is preserved irrespective of time aggregation • Model LRD process • H  1, the dependence is stronger

Background – Previous Model • Telephone call arrival process (70’s – 80’s) • Poisson Model • Independent inter-arrival time • Internet Traffic (90’s) • Self-similarity • Long-range dependence (LRD) • Heavy tailed distribution

Findings in the Paper • At Sub-Second Scales • Poisson and independent packets arrival • At Multi-Second Scales • Nonstationary • At Larger Time Scales • Long Range Dependence

Traffic Traces • Traces from CAIDA (primary focus) • Internet backbone, OC48 link (2.5Gbps) • August 2002, January and April 2003 • Traces from WIDE • Trans-Pacific link (100Mbps) • June 2003

Traffic Traces • BC-pAug89 and LEL-PKT-4 traces • On the Self-Similar Nature of Ethernet Traffic. (1994) • W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson. • Wide Area Traffic: The Failure of Poisson Modeling. (1995) • V. Paxson and S. Floyd.

Traffic Traces • Analysis of OC48 traces • The link is overprovisioned • Below 24% link unilization • ~90% bytes (TCP) • ~95% packets (TCP)

Poisson at Sub-Second Time Scales • Distribution of Packet Inter-arrival Times • Red line – corresponding to exponential distribution • Blue line – OC48 traces • Linear least squares fitting  99.99% confidence

Poisson at Sub-Second Time Scales LBL-PKT-4 trace WIDE trace

Packet Size ACF Inter-arrival Time ACF 95% confidence interval of zero Poisson at Sub-Second Time Scales • Independence

Nonstationary at Multi-Second Time Scales • Rate changes at second scales • Changes detection • Canny Edge Detector algorithm change point

Nonstationary at Multi-Second Time Scales • Similar in BC-pAug89 trace

Nonstationary at Multi-Second Time Scales • Possible causes for nonstationarity • Variation of the number of active sources over time • Self-similarity in the traffic generation process • Change of routing

Nonstationary at Multi-Second Time Scales • Characteristics of nonstationary • Magnitude of the rate change events • Significant negative correlation at lag one • An increase followed by a decrease

Nonstationary at Multi-Second Time Scales • Duration of change free intervals • Follow the exponential distribution

LRD at Large Time Scales • Measure LRD by the Hurst exponent (H) estimators • LRD, H  1 • Point of Change (Dichotomy in scaling) • Below ~ 0.6, Above ~ 0.85 Point of Change

LRD at Large Time Scales • Effect of nonstationarity • Remove “nonstationarity” by moving average (Gaussian window) Point of Change

Conclusion • Revisit Poisson assumption • Analyzing a combination of traces • Different observations at different time scales • Network Traffic • Time-dependent Poisson • Backbone links only • Massive scale and multiplexing • MAY lead to a simpler model

Background – Definitions • Poisson Process • The number of arrivals occurring in two disjoint (non-overlapping) subintervals are independent random variables. • The probability of the number of arrivals in some subinterval [t,t + τ] is given by • The inter-arrival time is exponentially distributed

A Nonstationary Poisson View of Internet Traffic