Packet Trains--Measurements and a New Model for Computer Network Traffic

Traffic measurements on a ring local area computer network at the Massachusetts Institute of Technology are presented. The analysis of the arrival pattern shows that the arrival processes are neither Poisson nor compound Poisson. An alternative model called "packet train" is proposed. In the train model, the traffic on the network consists of a number of packet streams between various pairs of nodes on the network. Each node-pair stream (or node-pair process, as we call them) consists of a number of trains. Each train consists of a number of packets (or cars) going in either direction (from node A to B or from node B to A). The intercar gap is large (compared to packet transmission time) and random. The intertrain time is even larger. The Poisson and the compound Poisson arrivals are shown to be special cases of the train arrival model. Another important observation is that the packet arrivals exhibit a "source locality." If a packet is seen on the network going from A to B, the probability of the next packet going from A to B or from B to A is very high. Implications of the train arrivals and of source locality on the design of bridges, gateways, and reservation protocols are discussed. A numbet of open problems requiring development of analysis techniques for systems with train arrival processes are also described.     

LÉvy Flights and Fractal Modeling of Internet Traffic

The relation between burstiness and self-similarity of network traffic was identified in numerous papers in the past decade. These papers suggested that the widely used Poisson based models were not suitable for modeling bursty, local-area and wide-area network traffic. Poisson models were abandoned as unrealistic and simplistic characterizations of network traffic. Recent papers have challenged the accuracy of these results in today's networks. Authors of these papers believe that it is time to reexamine the Poisson traffic assumption. The explanation is that as the amount of Internet traffic grows dramatically, any irregularity of the network traffic, such as burstiness, might cancel out because of the huge number of different multiplexed flows. Some of these results are based on analyses of particular OC48 Internet backbone connections and other historical traffic traces. We analyzed the same traffic traces and applied new methods to characterize them in terms of packet interarrival times and packet lengths. The major contribution of the paper is the application of two new analytical methods. We apply the theory of smoothly truncated Levy flights and the linear fractal model in examining the variability of Internet traffic from self-similar to Poisson. The paper demonstrates that the series of interarrival times is still close to a self-similar process, but the burstiness of the packet lengths decreases significantly compared to earlier traces.      

Throughput of DS‐CDMA/unslotted ALOHA radio networks with Markovian arrival processes

Previous works on the throughput analysis of the direct sequence‐code division multiple access/unslotted ALOHA radio network all used the Poisson arrival process (PAP). However, the interarrival times of PAP are independent, so it is not suited to model today's Internet and multimedia traffic, which have correlated interarrival times. We are motivated to use the Markovian arrival process (MAP), a more general input traffic model that captures the correlation of interarrival times. We are the first to analyze the throughput of the direct sequence‐code division multiple access/unslotted ALOHA radio network with MAP. We propose the use of MAP, which encompasses the PAP as a special case. The new MAP model basically generalizes the current traffic and queuing models of multimedia in wireless networks. Copyright © 2011 John Wiley & Sons, Ltd.     

Practical evaluation of encrypted traffic classification based on a combined method of entropy estimation and neural networks

Encrypted traffic classification plays a vital role in cybersecurity as network traffic encryption becomes prevalent. First, we briefly introduce three traffic encryption mechanisms: IPsec, SSL/TLS, and SRTP. After evaluating the performances of support vector machine, random forest, naïve Bayes, and logistic regression for traffic classification, we propose the combined approach of entropy estimation and artificial neural networks. First, network traffic is classified as encrypted or plaintext with entropy estimation. Encrypted traffic is then further classified using neural networks. We propose using traffic packet’s sizes, packet's inter‐arrival time, and direction as the neural network's input. Our combined approach was evaluated with the dataset obtained from the Canadian Institute for Cybersecurity. Results show an improved precision (from 1 to 7 percentage points), and some application classification metrics improved nearly by 30 percentage points.     

Improved multipath routing with WNN for the open networks

Multipath routing mechanism is vital for reliable packet delivery, load balance, and flexibility in the open network because its topology is dynamic and the nodes have limited capability. This article proposes a new multipath switch approach based on traffic prediction according to some characteristics of open networks. We use wavelet neural network (WNN) to predict the node traffic because the method has not only good approximation property of wavelet, but also self-learning adaptive quality of neural network. When the traffic prediction indicates that the primary path is a failure, the alternate path will be occupied promptly according to the switch strategy, which can save time for the switch in advance. The simulation results show that the presented traffic prediction model has better prediction accuracy; and the approach based on the above model can balance network load, prolong network lifetime, and decrease the overall energy consumption of the network.     

A novel neural network traffic enforcement mechanism for ATMnetworks

ATM has been recommended by the CCITT as the transport vehicle for the future B-ISDN networks. In ATM-based networks, a set of user declared parameters that describes the traffic characteristics, is required for the connection acceptance control (CAC) and traffic enforcement (policing) mechanisms. At the call set-up phase, the CAC algorithm uses those parameters to make a call acceptance decision. During the call progress, the policing mechanism uses the same parameters to control the user's traffic within its declared values in order to protect the network's resources and avoid possible congestion problems. A novel policing mechanism using neural networks (NNs) is presented. This is based upon an accurate estimation of the probability density function (pdf) of the traffic via its count process and implemented using NNs. The pdf-based policing is made possible only by NNs because pdf policing requires complex calculations, in real-time, at very high speeds. The architecture of the policing mechanism is composed of two interconnected NNs. The first one is trained to learn the pdf of “ideal nonviolating” traffic, whereas the second is trained to capture the “actual” characteristics of the “actual” offered traffic during the progress of the call. The output of both NNs is compared. Consequently, an error signal is generated whenever the pdf of the offered traffic violates its “ideal” one. The error signal is then used to shape the traffic back to its original values     

异步光分组交换网的流量建模

研究了异步光分组交换网的流量特性，提出了网络流量的解析模型和近似模型。研究表明，在采用计时门限光分组组装算法的情况下，如输入IP流具有短程相关特性(ShortRangeDependent)，则光分组的到达间隔时间呈负指数分布，光分组的长度趋于高斯分布。     

Cross-Layer optimal connection admission control for variable bit rate multimedia traffic in packet wireless CDMA networks

Next generation wireless code division multiple access (CDMA) networks are required to support packet multimedia traffic. This paper addresses the connection admission control problem for multiservice packet traffic modeled as Markov modulated Poisson process (MMPP) with the quality of service (QoS) requirements on both physical layer signal-to-interference ratio (SIR) and network layer blocking probability. Optimal linear-programming-based algorithms are presented that take into account of SIR outage probability constraints. By exploiting the MMPP traffic models and introducing a small SIR outage probability, the proposed algorithms can dramatically improve the network utilization. In addition, we propose two reduced complexity algorithms that require less computation and can have satisfactory approximation to the optimal solutions. Numerical examples illustrating the performance of the proposed schemes are presented.     

基于神经网络的网络流量预测算法研究

网络流量预测有助于网络服务质量的提升和网络资源的合理分配,对优化网络管理与运营、保障用户体验质量至关重要。因特网业务的急剧增加和基础网络的快速发展导致网络流量变得更加复杂多样,传统网络流量预测模型难以保证较高的预测精度,而神经网络作为人工智能的重要分支,在预测复杂网络流量时具有显著优势。简述反向传播神经网络、径向基神经网络和长短期记忆神经网络的模型原理,通过分析这些神经网络预测不同时间尺度的网络流量结果,可总结其预测性能与优缺点,为基于神经网络的故障预测和故障定位的学术研究和实际应用提供技术支撑。     

An approximate stochastic analysis of the packet‐pair probing technique for available bandwidth estimation

The packet‐pair probing algorithm for network‐bandwidth estimation is examined and an approximate model is proposed for predicting its behaviour. The model replaces the Poisson arrival process with a Gaussian distribution and resolves the queue‐size profile into two separate components: A transient component representing the buffer‐emptying process and an equilibrium component representing the return to steady‐state behaviour. Comparison with discrete‐event simulation results shows that the model is accurate in single‐hop paths when utilization is ?70% when the cross‐traffic packets are ?½ the size of the probe packets. When extended to two‐hop paths, the model remains accurate for smaller cross‐traffic packets ($\leq\frac{1}{10}-\frac{1}{5}The packet‐pair probing algorithm for network‐bandwidth estimation is examined and an approximate model is proposed for predicting its behaviour. The model replaces the Poisson arrival process with a Gaussian distribution and resolves the queue‐size profile into two separate components: A transient component representing the buffer‐emptying process and an equilibrium component representing the return to steady‐state behaviour. Comparison with discrete‐event simulation results shows that the model is accurate in single‐hop paths when utilization is ?70% when the cross‐traffic packets are ?½ the size of the probe packets. When extended to two‐hop paths, the model remains accurate for smaller cross‐traffic packets ($\leq\frac{1}{10}-\frac{1}{5}$ the probe‐packet size). Copyright © 2008 John Wiley & Sons, Ltd.     

TELNET的客户端流量模型

本文针对英特网上的一个常用协议－远程登录（ＴＥＬＮＥＴ）协议分析了它的客户端数据包产生的时间间隔分布,发现泊松模型的指数分布不能很好地刻画它的特性。本文依据Ｔｃｐｌｉｂ提供的经验分布曲线,认为Ｐａｒｅｔｏ分布在很大时间范围内能较好地描述ＴＥＬＮＥＴ的客户端流量特性,并对其突发序列的特性进行了分析。本文最后指出在描述网络流量时自相似模型要比泊松模型有效和精确得多,并给出了Ｐａｒｅｔｏ分布在建立自相似     

Modeling multiple IP traffic streams with rate limits

We start with the premise, and provide evidence that it is valid, that a Markov-modulated Poisson process (MMPP) is a good model for Internet traffic at the packet/byte level. We present an algorithm to estimate the parameters and size of a discrete MMPP (D-MMPP) from a data trace. This algorithm requires only two passes through the data. In tandem-network queueing models, the input to a downstream queue is the output from an upstream queue, so the arrival rate is limited by the rate of the upstream queue. We show how to modify the MMPP describing the arrivals to the upstream queue to approximate this effect. To extend this idea to networks that are not tandem, we show how to approximate the superposition of MMPPs without encountering the state-space explosion that occurs in exact computations. Numerical examples that demonstrate the accuracy of these methods are given. We also present a method to convert our estimated D-MMPP to a continuous-time MMPP, which is used as the arrival process in a matrix-analytic queueing model.     

Distributed and Energy-Aware MAC for Differentiated Services Wireless Packet Networks: A General Queuing Analytical Framework

We present a novel queuing analytical framework for the performance evaluation of a distributed and energy-aware medium access control (MAC) protocol for wireless packet data networks with service differentiation. Specifically, we consider a node (both buffer-limited and energy-limited) in the network with two different types of traffic, namely, high-priority and low-priority traffic, and model the node as a MAP (Markovian arrival process)/PH (phase-type)/1/K nonpreemptive priority queue. The MAC layer in the node is modeled as a server and a vacation queuing model is used to model the sleep and wakeup mechanism of the server. We study standard exhaustive and number-limited exhaustive vacation models both in multiple vacation case. A setup time for the head-of-line packet in the queue is considered, which abstracts the contention and the back-off mechanism of the MAC protocol in the node. A nonideal wireless channel model is also considered, which enables us to investigate the effects of packet transmission errors on the performance behavior of the system. After obtaining the stationary distribution of the system using the matrix-geometric method, we study the performance indices, such as packet dropping probability, access delay, and queue length distribution, for high-priority packets as well as the energy saving factor at the node. Taking into account the bursty traffic arrival (modeled as MAP) and, therefore, the nonsaturation case for the queuing analysis of the MAC protocol, using phase-type distribution for both the service and the vacation processes, and combining the priority queuing model with the vacation queuing model make the analysis very general and comprehensive. Typical numerical results obtained from the analytical model are presented and validated by extensive simulations. Also, we show how the optimal MAC parameters can be obtained by using numerical optimization     

A delay damage model selection algorithm for NARX neural networks

Recurrent neural networks have become popular models for system identification and time series prediction. Nonlinear autoregressive models with exogenous inputs (NARX) neural network models are a popular subclass of recurrent networks and have been used in many applications. Although embedded memory can be found in all recurrent network models, it is particularly prominent in NARX models. We show that using intelligent memory order selection through pruning and good initial heuristics significantly improves the generalization and predictive performance of these nonlinear systems on problems as diverse as grammatical inference and time series prediction     

一种基于小波变换和FIR神经网络的广域网网络流量预测模型

该文提出了一种基于小波变换和FIR神经网络的广域网网络流量预测模型,首先采用小波分解把网络流量数据分解成小波系数和尺度系数,即高频系数和低频系数,将这些不同频率成分的系数单支重构为高频流量分量和低频流量分量,利用FIR神经网络对这些分量分别进行预测,将合成之后的结果作为原始网络流量的预测。实验结果表明:采用该模型对实际的广域网网络流量数据进行预测,不仅可以得到较快的收敛效果,而且预测性能比现有的小波神经网络和FIR神经网络要好得多。     

数据分组网中自相似业务模型的研究进展

本文介绍了数据分组网络中业务模型的研究进展。数据分组网络中，传统的泊松或马尔科夫模型在描述网络业务的精确性方面有很大的不足，近年来发展的自相似（单元形）业务模型效果较好。最近，研究人员在实测网络业务数据的基础上提出的多分形模型，不但能很好地模拟网络业务的长相关性，还能表现其在小的时间尺度下的特性。本文简单介绍了单分形业务模型，然后对多分形业务模型进行了重点的阐述，对业务模型的研究进展做出了分析。     

面向软件定义核心网的OpenFlow分组转发优先制排队模型研究

软件定义网络（Software-Defined Networking,SDN）作为一种数据转发与控制逻辑相解耦、并开放底层编程接口的创新网络架构,为降低核心网的部署运营成本、提升应用业务性能提供了全新的解决思路.然而,在SDN架构下,逻辑上集中的控制平面容易出现性能瓶颈,进而加大分组转发时延,因此有必要理解其分组转发性能特性.为此,本文首先介绍了软件定义核心网的典型部署场景,分析了控制平面的Packet-in消息到达过程和数据平面的分组到达过程,进而应用M/M/n/m和M/M/1/m排队模型分别刻画控制器集群的Packet-in消息处理过程和OpenFlow交换机的分组处理过程.在此基础上,建立OpenFlow分组转发优先制排队模型,进而推导出不同优先级的分组转发时延及其累积分布函数CDF.最后,借助控制器性能测量工具OFsuite_Performance进行实验评估,结果表明：与现有模型相比,本文所提的M/M/n/m模型更能准确估计控制器集群的实际性能.同时,采用数值分析的方法对比了多种情况下不同优先级的分组转发时延及CDF曲线,为软件定义核心网的实际应用部署提供有效参考.     

Models for Wireless Data Communications in Indoor Train Environment

The provisioning of wireless data services in the railway environment will become increasingly important for train operators and train constructors in the upcoming years. In this paper, we present models to predict train-to-wayside wireless data communications characteristics in terms of throughput, jitter, and packet loss predictions for 2G/3G networks. To this end, an extensive measurement campaign is carried out along a Belgian Intercity railway track. Based on these measurements, we apply a multiple regression, window mean, and autoregressive model. We find that the window mean model is recommended for the prediction of throughput and jitter, while the multiple regression model is more favorable for the prediction of packet loss. The implementation of these predictions in train-to-wayside communication systems can enhance the provisioning of seamless network connection necessary for a wide variety of data services.     

Infinite-Mode Networks for Motion Control

In this paper, a novel multiple-input-multiple-output network model entitled "infinite-mode networks" (IMNs) is explained. The model proposes a new and challenging design concept. It is a dual structure and combines neural networks (NNs) to linear models. It has mathematically clear input-output relationship as compared to NNs. The model has a desired embedded internal function, which roughly determines a route for the whole system to follow as DNA does for biological systems. By this model, infinitely many error dimensions can be defined, and each error converges to zero in a stable manner. The network outputs include logical combinations of infinite modes of reference states, which consequently result in a substantial improvement of the control system performance. In order to support the network theory, time-delay and noise-suppression experiments on a four-channel haptic bilateral teleoperation control system are analyzed. An analysis between NNs, sliding-mode NNs, and IMNs is introduced. Possible future applications of IMNs are discussed.