Internet Signal Processing: Next Steps Dr. Craig Partridge BBN Technologies

Defining Signal Processing Processing—such as shaping, converting, enhancing, and time positioning—of signals (such as packet traces), to transform the signals into other forms — such as shapes, power levels, or images — and thereby extract features from the original signal.

Internet Signal Processing While there have been brief uses in the past –E.g. Jacobson on timing We’re only now seeing an emerging community of people doing signal processing on Internet traffic –And most of that community is in this room Where should we, as a community, be headed? –This is not a question we’ve had a chance to consider as a group (thus this workshop)

Whither? In Three Questions Is there more to signal processing than pretty pictures? What can signal processing illuminate? –What are the limits of different algorithms? What should our input signals be?

Pretty Pictures Why do we create pretty pictures? –Initial experiments with an algorithm –Try it on things and see what pops out The danger comes when we publish those pictures without understanding them –“This traffic pattern causes this picture” is something we should aim not to do Unless you’re asking for help –Seek rather “This traffic pattern causes this picture because….”

Some Not-Yet-Ready Pictures Delta-time analysis Inter-transmission time vs. transmission time Bands represent observed acceptable transmission times Low part of chart may reveal MAC layer in use…

What Can We Illuminate? What can signal processing tell us about the network? We need to find out. Can: –Seek out algorithms and try them –Seek out problems and find algorithms that might answer them –Seek out inputs to feed to algorithms we understand –At this point, we probably need to try all three approaches

Some Thought Questions How much does cross traffic “imprint”? What are wavelets good for? When are wavelets the wrong approach? What role for match-and-latch?

Imprinting Propagation of self-similarity work… An intriguing result from signal processing… Characteristics from all three flows observed But only two visible to sensor!

Pros and Cons of Wavelets Pro: –we’ve used them a lot and we understand a few things –how to compute Hurst parameter –how their details tend to vary Con: –they’re bad at identifying particular frequencies –often hard to say exactly why details vary BTW: these are questions we should ask ourselves about any technique going forward

Match-and-Latch A technique for extracting signals from noisy input Requires: – signals to have a structure that enables the extraction –that we be sure the signals are present One useful structure: signals expressable in max- plus algebra –TCP is max-plus (SIGCOMM 2000)

What Should Input Signals Be? Typical practice: –take a packet trace –post process it into a signal sample it in some fashion (method usually not described in paper…) usually only use arrival time and length usually resulting in either bins of event counts or a (-1,0,1) uniformly sampled signal

Why Can’t an Input …. Be something other than a packet trace –up-down times for BGP peers? –byte counts per unit time? Use more information from the trace –encoding source and destination prefixes? –power levels on wireless? –multi-dimensional signals? Be properly documented in the paper…

Final Thoughts Having put a lot of challenges on the table, let me say we’ve also come a long way in a short time –Lots of interesting work, which you’ll hear over the next few days –I encourage you to view it all (no matter how impressive) as a starting point…. A final challenge: –Why are we using signal processing only for analysis? –Are there applications we could transform with signal processing? (Beyond covert channels)