Semi-Experiments and the Modelling of Internet Traffic - SAMSI

Semi-Experiments and the Modelling of Internet Traffic
Nicolas Hohn ∗ Darryl Veitch ∗ Patrice Abry †
∗ CUBIN, Dept. of Electrical & Electronic Engineering, University of Melbourne.
† CNRS, UMR 5672, Laboratoire de Physique, ENS Lyon

Flows: the Structure Underlying the Packet Arrival Process
Flow arrivals:
Y (t)
Packet arrivals:
X(t)
Time
Seek statistically and physically meaningful stationary point process models.
1

Study Second Order Structure, Using Wavelet Spectra
Use the Discrete Wavelet Transform
Definition
Comparison of signal X(t) with family of functions ψ j,k via d X (j, k) =< X, ψ j,k >, where the
ψ j,k = 2 −j/2 ψ(2 −j t − k), are localised both in time and frequency.
Properties
• {d X (j, k), k ∈ Z} is stationary and short range dependent for fixed scale j,
• variance(j) = IE|d X (j, k)| 2
• For self-similar processes: IE|d X (j, k)| 2 = 2 jα E|d X (0, k)| 2 ,
• For LRD processes: IE|d X (j, k)| 2 ∼ 2 jα IE|d X (0, k)| 2 for large j.
Wavelet Spectrum Estimate (log-log plot):
log 2 [ 1 ∑
|d X (j, k)| 2 ]
n j
vs j
k
2

Estimated Wavelet Spectrum for X(t)
20
0.016 0.062 0.25 1 4 16 64 256 1024
18
16
log 2
Variance( j )
14
12
10
8
6
4
−6 −4 −2 0 2 4 6 8 10
scale j
3

Biscaling
20
0.016 0.062 0.25 1 4 16 64 256 1024
18
16
log 2
Variance( j )
14
12
10
8
6
4
−6 −4 −2 0 2 4 6 8 10
scale j
4

Periodogram
20
18
Periodogram
16
14
log 2
P
12
10
8
6
4
−10 −8 −6 −4 −2 0 2 4 6
log 2
f
5

Periodogram vs Wavelet Spectrum
20
18
Periodogram
Wavelet
16
14
log 2
P
12
10
8
6
4
−10 −8 −6 −4 −2 0 2 4 6
log 2
f
6

Flows: the Structure Underlying the Packet Arrival Process
Flow arrivals:
Y (t)
Packet arrivals:
X(t)
Time
Seek statistically and physically meaningful stationary point process models.
7

Similar ‘Biscaling’ in both Y and X for TCP Flows, Connected?
Y
X
log 2
Var( d j
)
16
14
12
10
8
0.016 0.062 0.25 1 4 16 64 256 1024
AUCK2
AUCK4
Var ( d j
)
30.5mus 977mus 0.031 1 32 1024
10
8
6
4
AUCK−a0
AUCK−b0
AUCK−c0
AUCK−c1
AUCK−d0
AUCK−d1
UNC−a0
UNC−a1
Abilene
Mel ISP−1
Mel ISP−2
Mel ISP−3
2
6
(a)
0
4
−6 −4 −2 0 2 4 6 8 10
j = log 2
( a )
−15 −10 −5 0 5 10
j = log 2
(a)
Observations for both X, Y
• Small scales: scaling behaviour?
• Characteristic scale, ‘knee’: function of ?
• Large scales: LRD, due to what?
Connections between X, Y
• Y ⊂ X
• Structural: inter and intra-flow dependencies
8

Is X the Flesh on the Y Skeleton?
Investigative Method
• Look at data subsets to isolate sources of key statistical features.
• IP–reconstruction: add in-flow models to real flow arrivals and compare.
Poor agreement!
New Approach
• Drop a priori ideas
• Systematic use of semi-experiments
9

Empirical Data
IP flow: set of packets with the same 5-tuple
IP Source Destination Source Destination
protocol Address Address Port Port
10

Extracting Flow Information
IP flow: set of packets with the same 5-tuple
IP Source Destination Source Destination
protocol Address Address Port Port
Time
11

Extracting Flow Information
IP flow: set of packets with the same 5-tuple
IP Source Destination Source Destination
protocol Address Address Port Port
Time
12

Benefits
The Semi-Experimental Method
Replacing selected aspects of data with model substitutes
• Understand the impact of a particular feature on overall statistics
• Enables ‘convenient’, highly flexible virtual experimentation
• Avoids need to model all aspects simultaneously
• Enables physically meaningful parameters to be directly targeted
Classes of manipulations performed:
[A] on Flow Arrival process
[P] on Packet arrival process within a flow
[S] Selection of flows according to number of packets, duration, rate, address, burstiness ....
[T] Truncation of flows according to number of packets, duration, silence duration ....
A Modelling Continuum:
primitive SE −→ compound SE −→ class search SE −→ semi-model −→ physical model
(neutral model) (multi-aspect) (model choosing) (1 data aspect) (no data)
13

Original TCP Data
Time
14

Original TCP Data
DATA EXPERIMENT
Time
15

Permutation of Flows [A-Perm]
DATA EXPERIMENT
Time
16

Permutation of Flows [A-Perm]
20
18
0.016 0.062 0.25 1 4 16 64 256 1024
Data
[A−Perm]
16
log 2
Variance( j )
14
12
10
8
6
4
−6 −4 −2 0 2 4 6 8 10
scale j
17

Original Order Poisson Arrivals [A-Pord]
DATA EXPERIMENT
(a smooth form of internal shuffling)
Time
18

Original Order Poisson Arrivals [A-Pord]
DATA EXPERIMENT
Time
19

Original Order Poisson Arrivals [A-Pord]
20
18
16
0.016 0.062 0.25 1 4 16 64 256 1024
Data
[A−Perm]
[A−Pord]
log 2
Variance( j )
14
12
10
8
6
4
−6 −4 −2 0 2 4 6 8 10
scale j
20

Permuted Poisson Arrivals [A-Pois]
DATA EXPERIMENT
Time
21

Permuted Poisson Arrivals [A-Pois]
20
18
16
0.016 0.062 0.25 1 4 16 64 256 1024
Data
[A−Perm]
[A−Pord]
[A−Pois]
log 2
Variance( j )
14
12
10
8
6
4
−6 −4 −2 0 2 4 6 8 10
scale j
22

What have we learned so far ?
Flow Arrival Manipulation
• Correlations between flows can be neglected
• No need for session level hierarchical models
• TCP dynamics between flows can be neglected
• For IP modelling, flow arrivals can be modelled as Poisson
• Justifies an assumption commonly used in traffic modelling.
Note: true flow arrival process is LRD.
23

Uniform In-Flow Arrivals [A-Pois; P-Uni]
DATA EXPERIMENT
Time
24

Uniform In-Flow Arrivals [A-Pois; P-Uni]
20
18
16
0.016 0.062 0.25 1 4 16 64 256 1024
Data
[A−Pois]
[A−Pois; P−Uni]
log 2
Variance( j )
14
12
10
8
6
4
−6 −4 −2 0 2 4 6 8 10
scale j
25

What have we learned so far ?
Flow Arrival Manipulation
• Correlation between flows can be neglected
• For IP modelling, flow arrivals can be modelled as Poisson
Packets Within Flow Manipulation
• LRD not caused by arrival process of packets within flows
• Small scale behaviour governed by structure within flows
• Source of structure (scaling ?) at small scales identified
26

Uniform distribution of packets [A-Pois; P-Uni]
DATA EXPERIMENT
Time
27

Rejection of Large Flows [A-Pois; P-Uni; S-Pkt]
DATA EXPERIMENT
Time
28

Rejection of Large Flows [A-Pois; P-Uni; S-Pkt]
20
18
16
0.016 0.062 0.25 1 4 16 64 256 1024
Data
[A−Pois]
[A−Pois; P−Uni]
[A−Pois; P−Uni; S−Pkt]
log 2
Variance( j )
14
12
10
8
6
4
−6 −4 −2 0 2 4 6 8 10
scale j
29

Flow Arrival Manipulation
Semi-Experiment Outcomes
• Correlation between flows can be neglected,
• For IP modelling, flow arrivals can be modelled as Poisson,
• [A-Clus]: knee of Y affects knee of X!
Packets within Flow Manipulation
• LRD not caused by arrival process of packets within flows,
• Small scale behaviour governed by structure within flows,
• Finite Poisson process a reasonable 0-th order model,
• [P-Pois]: indistinguishable from [P-Uni],
• [P-ConstR]; [P-ScaledR]: rate acts like a scale parameter,
Flow Selection
• Observed LRD caused by heavy-tailed flow volumes,
• [S-Thin]: random thinning consistent with independent flows,
• [S-Dur]: also kills LRD (flow duration slaved to volume),
• [S-Pkt]: LRD still present even without heavy tail!
Flow Truncation Manipulation
• [T-Pkt]: also kills LRD, makes X tend to Y ,
30

Poisson (Barlett-Lewis) Cluster Processes
Definition
• A Poisson process of seeds (flows), initiating independent groups of points (packets):
X(t) = ∑ i
G i (t − t F (i))
• Group: a finite renewal process with P points and inter-arrival distribution A:
G i (t) =
P (i)
∑
j=1
δ( t −
∑j−1
l=1
A i (l) )
Parameters
• Flow arrivals: constant intensity λ F
• Flow structure:
1
• Packet arrivals: A,
EA = λ A 0
• Flow volume: P , IEP = µ P

Properties of X(t), and Model Features
• λ X = µ P λ F (does not involve λ A )
• Point process, hence inherently ‘positive’
• Physically meaningful structure and parameters
• Fourier spectrum Γ X (ν) known
• Inter-arrival distribution known (in principle)
• Simple direct simulation (except transient)
• Potentially tractable queueing theory
32

Fourier Spectrum
Γ X (ν) = λ F ( µ P
λ A
Γ G (ν) + (S G (ω) + S G (−ω)) ),
Γ G (ν): spectrum of stationary renewal process with inter-arrivals A, and
R( S G (ω) ) =
Φ A (ω)
(1 − Φ A (ω)) 2(G P(Φ A (ω)) − 1).
Verify LRD:
R( S G (ω) )
ω→0
∼
ω→∞
∼
where B(β) = ψ(1 − β) cos(πβ/2)/(2π) (2−β) > 0
LB(β)(2πλ A ) 2−β ω −(2−β) → ∞
cos(cπ/2)
− → 0
(bω) c
Properties
• λ F just a variance multiplier: ‘more of same’
• has scale parameter 1/λ A if A has: Γ X (ω; λ F , λ A , c, F P ) = Γ X (ω/λ A ; λ F , 1, c, F P )
• Two terms dominating small-large scales
• First term (small scales): scaled renewal process, no detailed P dependence
• Second term (large scales): LRD, no A dependence beyond λ A
33

Modelling Flows: Averages over Flows
Tail of P
Tail of D
log( Pr[ P > k ] )
0
−1
−2
−3
−4
−5
AUCK
UNC
Abilene
Mel ISP
−6
0 1 2 3 4 5 6
log( k )
log( Pr[ D > x ] )
0
−0.2
−0.4
−0.6
−0.8
−1
−1.2
−1.4
−1.6
−1.8
−2
AUCK
UNC
Abilene
Mel ISP
−0.5 0 0.5 1 1.5 2 2.5
log( x sec )
• Slave durations to P
• Heavy tail for P , use hyperbolic variable H(k; a, β)
F H (k; a, β) = 1 − (ak + 1) −β ∼ 1 − Lk −β k = 1, 2, · · ·,
• To match L and β and µ P , vary mixture parameter p ∈ [0, 1] for fixed (γ, a 2 ) = (2.5, 0.01):
F P (k; p, a, β) = pF H (k; a 2 , γ) + (1 − p)F H (k; a, β)
• Careful of power-law body, not just far tail!
34

Modelling Flows: Variety Within Flows
Volume and Rate
Coefficient of variation
4
4
(b)
−2
(c)
2.5
−2.5
2
−3
log( P )
2
−3.5
log( P )
2
1.5
1
−4
−4.5
0.5
0
−2 −1 0 1 2 3
log( R )
−5
0
−2 −1 0 1 2 3
log( R )
0
• Underlying scatterplot, one point per flow. Discretisation essential for clarity.
• Wide range of rates, but no bimodality - suggests single class
• P quasi independent of rate
• Wide range of variability in flows, but fairly constant in centre of flow mass
* Suggests single representative rate with weighted constant C-of-V
35

Use Gamma Inter-arrivals for A
Semi-experiments: Poisson (stationarity) reasonable, but burstiness needed
Gamma-Renewal: Not an Arbitrary Choice:
• Contains exponential as special case
• Has a scale parameter of the right form: b ∝ λ −1
A
• Flexible family with minimum number of physical parameters
• Explicit cf:
Φ A (ω; b, c) = (1 − ibω) −c
• Explicit spectrum:
Γ X (ν) = λ A [(1 − Φ A (ω)) −1 + (1 − Φ A (−ω)) −1 − 1]
• Spectrum monotone for c < 1 (over-dispersed)
36

Small Scales Problematic
Care Needed with Wavelet Spectrum
• Highly non-Gaussian: can’t use Gaussian-derived CI’s
• Initialisation errors for DWT: simple counts with Haar exact for point processes
• Discrete series: need to use modified approach, special initialisation
Remember are taking logs..
• Superpose n i.i.d copies −→ n∗variance −→ add n
• Adding not linear! eg:
Poisson & fGn Poisson & GR GR & fGn
10
0.031 1 32 1024
(a)
977mus 1 1024
−3
(b)
9
8
0.031 1 32 1024
(c)
log 2
Var( d j
)
5
0
−4
−5
−6
7
6
5
4
−5
−5 0 5 10 15
−7
−10 0 10
j = log 2
( a )
3
−5 0 5 10 15
37

Modelling a Typical Auckland IV Trace
0.0039 0.016 0.062 0.25 1 4 16 64 256 1024
20
18
Data
Model
GR component
Cluster component
Poisson limit
log 2
Var( d j
)
16
14
12
λ F
µ P
c
10
λ F
µ P
−8 −6 −4 −2 0 2 4 6 8 10 12
j = log 2
( a )
∗ : j ∗ = − log
GR 2 λ A + log 2 (π 2 (c + 1)/(3ɛc 2 ))
✷ : j ∗∗ = − log
PGR 2 λ A + 1
2 − β (log 2 µ P − log 2 (2LB(β)) − log 2 c)
38

Why Black Box GR Cannot Work (even at small scale)
0.0039 0.016 0.062 0.25 1 4 16 64 256 1024
19
17
Data
Model
GR component
Black box GR
log 2
Var( d j
)
15
13
11
9
7
5
−8 −6 −4 −2 0 2 4 6 8 10 12
j = log 2
( a )
39

The Body of P Impacts Medium Scales
25
23
21
977mus 0.0039 0.016 0.062 0.25 1 4 16 64 256 1024
Data
Model
Model with empirical P(i)
[ A−Pois; S−Pkt ]
upper limit from eq. (15)
lower limit
log 2
Var( d j
)
19
17
15
13
11
−10 −8 −6 −4 −2 0 2 4 6 8 10
j = log 2
( a )
40

OC48 Data, New Features
27
25
61mus 244mus977mus 0.0039 0.016 0.062 0.25 1 4 16 64 256
Data
Model with empirical P(i)
GR component
Cluster component
log 2
Var( d j
)
23
21
19
17
−14 −12 −10 −8 −6 −4 −2 0 2 4 6 8
j = log 2
( a )
41

The Center of Gravity has Shifted
Flow Density
Packet Density
6
−1.5
6
−1.5
(a)
(b)
−2
−2
4
−2.5
4
−2.5
log( P )
−3
−3.5
log( P )
−3
−3.5
2
−4
2
−4
−4.5
−4.5
0
−2 −1 0 1 2 3
log( R )
−5
0
−2 −1 0 1 2 3
log( R )
−5
Packet weighting of flows essential
42

Just Second Order?
80
(b)
80
(a)
number of packets
60
40
20
number of packets
60
40
20
0
0 2 4 6 8 10
time (sec)
0
0 2 4 6 8 10
time (sec)
Data and Model hard to distinguish at all aggregation levels
43

Using the Model for Scenario Exploration
Can Investigate
• Tradeoffs of increasing multiplexing, access rates, file sizes...
• Study how burstiness changes as a function of scale
• Inter-arrivals, becoming more Poisson? X → Poisson?
– tradeoff of burstiness and perspective changes (simple answer, No)
• Separate burstiness structure from point process limits
– pseudo-slopes at small scale can be misinterpreted as ’multifractality’
44

Some Next Steps
Data
• Find source of new behaviour in OC48
• Determine if multiclass necessary (spectrum tractable)
• Analyse more traces
Model
• Calculate higher order properties
• Calculate spectra of model extensions
• Cluster/D/1 queueuing
45