Segment-based adaptive hyper-Erlang model for long-tailed network traffic approximation

Modeling the long-tailedness property of network traffic with phase-type distributions is a powerful means to facilitate the consequent performance evaluation and queuing based analysis. This paper improves the recently proposed Fixed Hyper-Erlang model (FHE) by introducing an adaptive framework (Adaptive Hyper-Erlang model, AHE) to determine the crucially performance-sensitive model parameters. The adaptive model fits long-tailed traffic data set directly with a mixed Erlang distribution in a new divide-and-conquer manner. Compared with the well-known hyperexponential based models and the Fixed Hyper-Erlang model, the Adaptive Hyper-Erlang model is more flexible and practicable in addition to its accuracy in fitting the tail behavior.

Comment on “A general model for long-tailed network traffic approximation”

The recent paper by Wang et al. (J. Supercomput. 38:155–172, 2006) proposed a Hyper Erlang model for long-tailed network traffic approximation. The paper argued that traditional models such as the Pareto, Weibull and log normal distributions are difficult to apply because of “their complex representations and theoretical properties”. The paper went on to say that the Pareto distribution “does not have analytic Laplace transform, and many other heavy-tailed distributions, such as Weibull and log normal also do not have closed-form Laplace transforms”. In the following, we would like to show that one can actually derive explicit expressions for Laplace transforms of heavy-tailed distributions. The next three sections provide explicit expressions for the Laplace transforms of the Pareto, Weibull and the log-normal distributions. To the best of our knowledge, these are the first known results on Laplace transforms of heavy-tailed distributions.

---

A study of traffic, user behavior and pricing policies in a large campus network

Tsinghua University campus network is a large campus network in China, providing volume-based and flat-rate Internet access service for more than 31,000 students and staff. In order to better understand its traffic, user behavior and pricing policies to facilitate network planning and management, we collect a one-year-long flow-based traffic log and a 10-year-long user-based log at the boundary of this campus network, and then conduct an analysis study on these two data sets. In this paper, we first present characteristics of inbound traffic flows from the aspects of traffic prediction and inference. Then we analyze the geographical origins of incoming flows, and the result reveals that USA, Japan and Korea are the most important source countries of international traffic. Our user-based investigation shows that the properties of users have important influence on their behavior, e.g., major has stronger influence on users’ online time, while occupation has stronger influence on users’ international traffic volume. We also find that there are more and more users choosing flat rate pricing scheme instead of volume based pricing scheme, and these users tend to over-provision when they subscribe from tiered pricing options.     

基于集成SVM和Bagging的未知恶意流量检测

未知恶意网络流量检测是异常检测领域亟待解决的核心问题之一. 从高速网络数据流中获取的流量数据往往具有不平衡性和多变性. 虽然在恶意网络流量异常检测特征处理和检测方法方面已存在诸多研究, 但这些方法在同时解决数据不平衡性和多变性以及模型检测性能方面仍存在不足. 因此, 本文针对未知恶意网络流量检测目前存在的困难, 提出了一种基于集成SVM和Bagging的未知恶意流量检测模型. 首先, 针对网络流量数据的不平衡性, 提出一种基于Multi-SMOTE过采样的流量处理方法, 以提高流量处理后的特征质量; 第二, 针对网络流量数据分布的多样性, 提出一种基于半监督谱聚类的未知流量筛选方法, 以实现从具有多样分布的混合流量中筛选出未知流量; 最后, 基于Bagging思想, 训练了集成SVM未知恶意流量检测器. 实验结果表明, 本文所提出的基于集成SVM与Bagging的未知流量攻击类型检测模型在综合评价(F1分值)上优于目前同类未知恶意流量检测方法, 同时在不同数据集上具有较好的泛化能力.     

Evalvid-RA: trace driven simulation of rate adaptive MPEG-4 VBR video

Due to the increasing deployment of conversational real-time applications like VoIP and videoconferencing, the Internet is today facing new challenges. Low end-to-end delay is a vital QoS requirement for these applications, and the best effort Internet architecture does not support this natively. The delay and packet loss statistics are directly coupled to the aggregated traffic characteristics when link utilization is close to saturation. In order to investigate the behavior and quality of such applications under heavy network load, it is therefore necessary to create genuine traffic patterns. Trace files of real compressed video and audio are text files containing the number of bytes per video and audio frame. These can serve as material to construct mathematical traffic models. They can also serve as traffic generators in network simulators since they determine the packet sizes and their time schedule. However, to inspect perceived quality, the compressed binary content is needed to ensure decoding of received media. The EvalVid streaming video tool-set enables this using a sophisticated reassembly engine. Nevertheless, there has been a lack of research solutions for rate adaptive media content. The Internet community fears a congestion collapse if the usage of non-adaptive media content continues to grow. This paper presents a solution named Evalvid-RA for the simulation of true rate adaptive video. The solution generates real rate adaptive MPEG-4 streaming traffic, using the quantizer scale for adjusting the sending rate. A feedback based VBR rate controller is used at simulation time, supporting TFRC and a proprietary congestion control system named P-AQM. Example ns-2 simulations of TFRC and P-AQM demonstrate Evalvid-RA’s capabilities in performing close-to-true rate adaptive codec operation with low complexity to enable the simulation of large networks with many adaptive media sources on a single computer.     

基于NetFlow流量分析的网络攻击行为发现

针对当前网络攻击的特点，利用基于NetFlow协议的高性能数据采集模式并结合分布分析、频度分析等流量分析手段，实现了一种通过NetFlow流量分析发现网络攻击行为的方法。     

基于Pareto分布的IP骨干节点输入通信量模型

输入通信量的行为特性对于IP骨干网节点的性能和设计有重要的影响.本文从IP骨干网络节点输入通信量角度出发,提出了一个基于Pareto和指数分布的混合通信量模型,其中数据包到达间隔为Pareto分布,包大小为指数分布.该模型克服了传统网络通信量模型中没有显式考虑数据包大小的缺点,从数据包级对网络通信量进行了精确的描述,从而能够更好地进行路由器结构设计和性能分析.仿真实验验证了我们模型的有效性.     

Robust network planning in nonuniform traffic scenarios

Robustness to the environmental variations is an important feature of any reliable communication network. This paper reports on a network theory approach to the design of such networks where the environmental changes are traffic fluctuations, topology modifications, and changes in the source of external traffic. Motivated by the definition of betweenness centrality in network science, we introduce the notion of traffic-aware betweenness (TAB) for data networks, where usually an explicit (or implicit) traffic matrix governs the distribution of external traffic into the network. We use the average normalized traffic-aware betweenness, which is referred to as traffic-aware network criticality (TANC), as our main metric to quantify the robustness of a network. We show that TANC is directly related to some important network performance metrics, such as average network utilization and average network cost. We prove that TANC is a linear function of end-to-end effective resistances of the graph. As a result, TANC is a convex function of link weights and can be minimized using convex optimization techniques. We use semi-definite programming method to study the properties of the optimization problem and derive useful results to be employed for robust network planning purposes.     

一种计算话务量的进化神经网络方法

话务量是度量用户使用电话设备频繁程度的一个重要参量,由于目前话务分布呈现出显著的立体性、多业务性和非泊松流等特点,不能直接应用欧兰B公式进行计算。为此,从计算智能出发提出一种基于PSO算法的进化神经计算方法,主要包括话务量及其相关参量的获取、神经网络结构的优化、基于PSO算法的网络训练,以及话务量计算等步骤。通过对河北省某市小灵通业务的详细研究,利用近半年来的话务量与无线阻塞率、来话接通率和掉话率等参量构成的样本信息进行建模,所计算的话务量精度高,表明其方法切实可行且效果显著。     

基于网络流量小波分析的异常检测研究*

网络流量是局域网和广域网的重要特征之一,小波分析能将复杂的非线性网络流量时间序列分解成不同频率的子序列.基于小波分解的思想,利用网络流量的自相似特性来对网络的异常行为进行检测,给出了根据网络流量自相似特征参数的偏差来检测攻击的方法,对不同分辨率下Hurst参数的变化进行了比较分析.在DARPA上的测试结果表明,该方法不仅能够发现网络中存在的突发性流量攻击,还能够确定异常发生的位置.