Department of Telecommunications Zagreb, 2012 Modeling and generation of network traffic based on user behavior Mirko Suznjevic University of Zagreb, Faculty of Electrical Engineering and Computing Unska 3, Zagreb, Croatia

Department of TelecommunicationsProblem  Highly erratic traffic of complex Networked Virtual Environments (NVE)  Focus on games  How player behaviour at application level affects networks traffic characteristics  Single flow level  Aggregated flows  Implementation of behaviour based traffic generator  Results enable:  Better infrastructure planning and optimization  Testing Zagreb, /67

Department of Telecommunications Problem I  Highly variable bandwidth usage (client side) Zagreb, /67 Same application!

Department of Telecommunications Problem II  Server traffic patterns Zagreb, /67 M. Kihl, A. Aurelius, and C. Lagerstedt, “Analysis of World of Warcraft traffic patterns and user behaviour,” in International Congress on Ultra Modern Telecommunications and Control Systems and Workshops, 2010, pp. 218–223.

Department of TelecommunicationsOutline  Problem  Introduction  Categorization of user actions  Network traffic  Player behaviour  Traffic generator – UrBBaN-Gen  Conclusion Zagreb, /67

Department of TelecommunicationsOutline  Problem  Introduction  Categorization of user actions  Network traffic  Player behaviour  Traffic generator – UrBBaN-Gen  Conclusion Zagreb, /67

Department of TelecommunicationsDefinitions  “An NVE may be defined as a software system in which multiple users interact with each other in real time, even though those users may be located around the world”  Massively Multiplayer Online Role-Playing Game (MMORPG)  Players assume the role of a character (in a persistent virtual world) and take control over many of that character's actions  Currently the most popular application of NVEs  Client-server architecture Zagreb, /67 S. Singhal and M. Zyda, Networked Virtual Environments: Design and Implementation. Addison-Wesley Professional, 1999

Department of Telecommunications Economic aspects  Number of players is constantly increasing  460 MMORPGs active / in development (mmorpg.com)  54 million MMO players in USA alone  Why?  Players: A complex question…  Developers: Constant revenues  Business models  Subscription based  Selling content updates  Selling virtual items (micro transactions) Zagreb, /67 NewZoo, “National Gamers Survey 2010 | USA,” Tech. Rep., [Online]. Available:

Department of Telecommunications Number of subscriptions Zagreb, /67 I. V. Geel. (2012, Mar) Mmodata charts v3.8. [Online]. Available:

Department of Telecommunications Goal and approach  Goal:  To create a behaviour based MMORPG network traffic model  Steps:  Define what is application level player behaviour  Measure network traffic (in terms of defined behaviour)  Create models of network traffic  Measure player behaviour  Create models of player behaviour  Create a software implementation of the models (traffic generator) Zagreb, /67

Department of TelecommunicationsMethodology  Measurements  Network traffic  Player behaviour  Using existing datasets  Number of active players  Modelling  Network traffic  Application Protocol Data Unit (APDU)  Inter-arrival times (IAT)  Player behaviour  Number of active players  Session length  Transitions between action categories  Duration of action category specific session segments  Exploring psychological motivations Zagreb, /67

Department of Telecommunications Use case – World of Warcraft Zagreb, /67

Department of TelecommunicationsOutline  Problem  Introduction  Categorization of user actions  Network traffic  Player behaviour  Traffic generator – UrBBaN-Gen  Conclusion Zagreb, /67

Department of Telecommunications Player behaviour at the application level  Session lengths – OK  Number of players – OK  Session composition – ?  How to measure what exactly players do in MMORPG?  Many possible (inter)actions  Vast virtual worlds  Possibility of countless different situations  Classification (grouping) of possible situations in virtual world  Generally applicable  Based on both player input and surroundings  Meaningful in relation to game design  Approach based on user actions Zagreb, /67

Department of Telecommunications Classification - Questing Zagreb, /67

Department of Telecommunications Classification - Trading Zagreb, /67

Department of Telecommunications Classification - PvP combat Zagreb, /67

Department of Telecommunications Classification - Dungeons Zagreb, /67

Department of Telecommunications Classification - Raiding Zagreb, /67

Department of Telecommunications Classification - Final Zagreb, /67

Department of TelecommunicationsOutline  Problem  Introduction  Categorization of user actions  Network traffic  Player behaviour  Traffic generator – UrBBaN-Gen  Conclusion Zagreb, /67

Department of Telecommunications Methodology – Network traffic Zagreb, /67 Find experienced players Install Wireshark Perform specific tasks in game Create models Process data Submit.PCAP files Zagreb, /67

Department of Telecommunications Traffic capture  Performed by 6 experienced WoW players (volunteers)  Players instructed to capture action specific traffic  Traffic capture done with Wireshark  Main issue – immersion  Result – 83 context specific traces (1,395,940 packets) Zagreb, /67

Department of Telecommunications Traffic characteristics Zagreb, /67

Department of Telecommunications Traffic filtering  Large signalling overhead  Removed TCP ACK packets carrying no payload  Extraction of APDU sizes and inter-arrival times Zagreb, 2012 P. Svoboda and W. K. M. Rupp, Traffic analysis and modeling for World of Warcraft, In Communications, ICC '07. IEEE International Conference on, pages , /67

Department of Telecommunications APDU sizes and IATs are modelled for server and client traffic for each action category 1.Choosing an analytical distribution by examining CDF with the help of Q-Q plot 2.Choosing optimal bin size 3.Choosing a split distribution if the fit is deviating severely in a part of the distribution Traffic modeling methodology Zagreb, /67

Department of Telecommunications 4.Calculating the discrepancy measure Traffic modeling methodology II Zagreb, /67

Department of Telecommunications Traffic modeling methodology III 5.Examination of the tail 6.Calculating the autocorrelation Zagreb, /67

Department of Telecommunications Resulting model Zagreb, /67 A. Dainotti, A. Pescape, and G. Ventre, “A packet-level traffic model of Starcraft,” in HOT-P2P ’05: Proceedings of the Second International Workshop on Hot Topics in Peer-to-Peer Systems, 2005, pp. 33–42.

Department of TelecommunicationsOutline  Problem  Introduction  Categorization of user actions  Network traffic  Player behaviour  Traffic generator – UrBBaN-Gen  Conclusion Zagreb, /67

Department of Telecommunications Methodology – Player behaviour Find players Install WSA-Logger PLAY (WoW add-on) Create models Process data Submit log files Zagreb, /67

Department of Telecommunications Behaviour measurements 1st – initial study 2nd – main study (additionally, psychological motivations of players are measured) 3rd – additional study for better understanding of uncategorized periods (through location inspection) Zagreb, /67 MeasurementPlayers participating WoW VersionDuration 1st123.X6 weeks 2nd1043.X6 weeks 3rd154.X4 weeks

Department of TelecommunicationsWSA-Logger  Add-on for WoW  Events are fired by WoW API when something happens within the virtual world  Some events can be assigned to action categories  WSA-Logger captures and stores classified events in a log file  Players behaviour can be retraced from the log Zagreb, /67

Department of Telecommunications Action category identification Zagreb, /67

Department of Telecommunications Behaviour patterns Zagreb, /67

Department of Telecommunications Psychological motivations Zagreb, /67 N. Yee, “Experimental Motives for Playing Online Games,” Journal of CyberPsychology and Behavior, vol. 9, no. 6, pp. 772–775, 2007 Achievement Advancement MechanicsCompetition Social SocializingRelationship Teamwork Immersion DiscoveryRole-Playing Customization Escapism HypothesesAssociation H1. Advancement is positively associated with Raiding+ H2. Advancement is positively associated with PvP combat- H3. Mechanics is positively associated with PvP combat- H4. Competition is positively associated with PvP combatN/A H5. Socializing is positively associated with Communication+ H6. Relationship is positively associated with Communication+ H7. Teamwork is positively associated with Dungeons- - - H8. Teamwork is positively associated with Raiding+ H9. Discovery is positively associated with Questing+

Department of Telecommunications Model - Session length  Weibull distribution (confirms previous results)  Significant hourly differences Zagreb, /67

Department of Telecommunications Model – Player number  Modelled both arrival and departure processes as Homogenous Poisson Process (HPP)  Rates calculated for each hour of each day of the week  Two categories (weekdays and weekends ) Pitman et al. Dataset Lee et al. dataset Zagreb, /67 D. Pittman and C. GauthierDickey, “A Measurement Study of Virtual Populations in Massively Multiplayer Online Games,” in Proceedings of the 6th ACM SIGCOMM Workshop on Network and System Support for Games, 2007, pp. 25–30. Y.-T. Lee, K.-T. Chen, Y.-M. Cheng, and C.-L. Lei, “World of Warcraft avatar history dataset,” in Proceedings of the second annual ACM conference on Multimedia systems, 2011, pp. 123–128.

Department of Telecommunications Model – Player number II  Different scales of player number  Preserving “the shape of the curve”  Steps:  Normalization of the curve from existing datasets  Prediction of the number of players based on estimated average number of players during the day  Estimation of the parameters of the HPP based on the prediction Zagreb, /67 J.-E. Tyvand, K. Begnum, and H. Hammer, “Deja vu - Predicting the number of players in online games through normalization of historical data,” in Proceedings of 10th workshop on Network and system support for games, ser. NetGames ’11, 2011, p. 13:2

Department of Telecommunications Model – Number of players III Zagreb, /67

Department of Telecommunications Session composition  Session segment – part of the session containing only player actions of certain type  Duration  Probability Zagreb, /67 Questing Trading PvP Combat Questing Trading Session segments

Department of Telecommunications Model – Segment duration  Session segment duration for every hour of the day  Raiding – hour specific models  Other categories – 1 model for the whole day  Underlying distribution determined through Maximum Likelihood Estimation (MiniTab) Zagreb, /67 CategoryFit TradingWeibull QuestingWeibull PvP CombatWeibull Dungeons Largest Extreme Value UncategorizedWeibull Raiding HourData portionFit %Weibull 58%Weibull %Weibull 56%Lognormal %Weibull 58%Lognormal %Weibull %Weibull

Department of Telecommunications Segment duration goodness of fit  Questing, Trading, and PvP combat Zagreb, /67

Department of Telecommunications Segment duration goodness of fit II  Dungeons Zagreb, /67

Department of Telecommunications Segment duration goodness of fit III  Raiding Zagreb, /67

Department of Telecommunications Segment probability Zagreb, /67 Questing Trading PvP combat Raiding Dungeons

Department of Telecommunications Model – Segment probability  1 st order Markov chain for each hour of the day Zagreb, /67

Department of TelecommunicationsOutline  Problem  Introduction  Categorization of user actions  Network traffic  Player behaviour  Traffic generator – UrBBaN-Gen  Conclusion Zagreb, /67

Department of TelecommunicationsUrBBaN-Gen  User Behaviour Based Network Traffic Generator  Design ideas  Scalable  Virtualization  Expandable  Service independent  Modular  Low-cost Zagreb, /67

Department of Telecommunications Architecture of traffic generator based on player behaviour Zagreb, /67

Department of Telecommunications Used technologies Zagreb, /67 Java based GUI for control and visualization of the simulated service D-ITG for IP packet senders and receivers Linux containers for virtualization (LXC)

Department of Telecommunications Prototype implementation Zagreb, /67

Department of Telecommunications Porting to IMUNES  Integrated Multiprotocol Network Emulator Simulator  Charcteristics  Virtualization – FreeBSD jails  Network emulation and communication – Netgraph  Transactional file system – ZFS  Ability to create complex emulated networks – no need for network hardware (routers/switches) Zagreb /13

Department of Telecommunications IMUNES - GUI Zagreb /13

Department of Telecommunications IMUNES – improved scalability Zagreb /13

Department of Telecommunications Implementation – Dungeons client APDU size Zagreb, /67

Department of Telecommunications Implementation – PvP combat server APDU size Zagreb, /67

Department of Telecommunications Implementation – Questing client APDU IAT Zagreb, /67

Department of Telecommunications Implementation – Trading server APDU IAT Zagreb, /67

Department of Telecommunications Implementation – APDU size scalability validation Zagreb, /67

Department of Telecommunications Implementation – APDU IAT scalability validation Zagreb, /67

Department of TelecommunicationsScalability  TCP flows from one comodity PC  pps (LXCs)  pps (IMUNES)  More than simulated users  Expandability for LXC for IMUNES in development Zagreb, /67

Department of TelecommunicationsOutline  Problem  Introduction  Categorization of user actions  Network traffic  Player behaviour  Traffic generator – UrBBaN-Gen  Conclusion Zagreb, /67

Department of TelecommunicationsConclusion  Problem – highly erratic traffic on complex networked virtual worlds  Approach – inspecting how the player behaviour at application level affects network traffic characteristics  Trading  Raiding Zagreb, /67

Department of Telecommunications Conclusion II Zagreb, /67

Department of Telecommunications Conclusion III  Classification of user actions of MMORPGs has been created and the network traffic of each action category has been modelled  User behaviour model has been created based on the user action categories  An architecture and implementation of the user behaviour based traffic generator has been developed which was used to verify the models through comparison of synthetic and real traffic Zagreb, /67

Department of Telecommunications Applications in other areas  Simulation of complex sensor networks with many network traffic sources  Ability to simply create different behaviors (e.g., robot sending high definition video with full sensor information on one side, or robot just sending low quality video and receiving signaling information)  Creation and simulation of comlex networks and generation of traffic within that (e.g., add-hoc networks) Zagreb, /67