1. Wavelet-Based Network Traffic Modeling Carey Williamson University of Calgary

2. Introduction n Wavelets offer a powerful and flexible technique for mathematically representing network traffic at multiple time scales n Compact and concise representation of a signal using wavelet coefficients n Efficient O(N) technique for synthesizing signals as well, for N data points

3. Wavelets: Background n Wavelet transformation involves integrating a signal (continuous time or discrete) with a set of wavelet functions and scaling functions n Scaling: PHI(t) n Haar Wavelet: PSI(t)

4. Wavelets: Background n The top-level wavelet function is called the mother wavelet n The children are defined recursively using the relationship: –PHI (t) = 2 PHI(2 t - K) –PSI (t) = 2 PSI(2 t - K) where j is the (vertical) scaling level, and k is the (horizontal) translation offset, in a binary tree representation of the signal J,K J/2 J J,K J/2J

5. Wavelets: Background n Child wavelets are narrower and taller, and cover a specific subportion of the time series n Shifted versions of the wavelet function cover other portions of the time series n Entire time series can be expressed as a sum (or integral) of scaling coefficients U and wavelet coefficients W along with these functions J,K

6. Wavelets: Background n Wavelet coefficients keep track of information about the time series; in essence they keep track of the sums and/or differences between the wavelet coefficients at finer-grain time scale (plus a scaling factor) n Finest grain wavelet coefficients are derived directly from empirical time series, using C(k) = 2 Un,k n/2

7. Wavelets: Background n Coarser-grained values are computed recursively upwards using: –U = 2 (U + U ) –W = 2 (U - U ) n Topmost scaling coefficient represents mean of empirical time series n Wavelet coefficients capture the behavioural properties of the time series J-1,K -1/2 J,2K J,2K+1

8. Wavelets: Background n Empirical time series can be exactly reconstructed using only these values (i.e., the scaling and wavelet coefficients) n Furthermore, these coefficients become decorrelated in the wavelet domain (i.e., can model arbitrary signals)

9. Wavelets: An Example n Suppose the initial empirical time series of interest has N = 8 observations in it, namely: –17 7 12 6 10 15 8 13 (mean = 11.0) n Can construct binary tree representation of the signal and its corresponding scaling and wavelet coefficients

10. Wavelets: An Example 1771261015813

11. Wavelets: An Example 1771261015813 J=0 J=1 J=2 J=3

12. Wavelets: An Example 1771261015813 J=0 J=1 J=2 J=3 K=0 K=7

13. Wavelets: An Example 1771261015813 Compute scaling coefficients at bottom level 2 3/2 2 2 2 2 2 2 2 Un,k = 2 C(k) -n/2

14. Wavelets: An Example 1771261015813 Compute scaling coefficients at next level up 2 3/2 2 2 2 2 2 2 2 6 9/2 25/4 21/4 Uj-1,k = 2 (Uj,2k+Uj,2k+1) -1/2

15. Wavelets: An Example 1771261015813 Compute scaling coefficients at next level up 2 3/2 2 2 2 2 2 2 2 6 9/2 25/4 21/4 21 23 2 3/2 2

16. Wavelets: An Example 1771261015813 Compute scaling coefficient at top level 2 3/2 2 2 2 2 2 2 2 6 9/2 25/4 21/4 21 23 2 3/2 2 11

17. Wavelets: An Example 1771261015813 Now compute wavelet coefficients, bottom up 2 3/2 2 2 2 2 2 2 2 6 9/2 25/4 21/4 21 23 2 3/2 2 11 Wj-1,k = 2 (Uj,2k-Uj,2k+1) -1/2 5/2 3/2-5/4

18. Wavelets: An Example 1771261015813 Now compute wavelet coefficients, bottom up 2 3/2 2 2 2 2 2 2 2 6 9/2 25/4 21/4 21 23 2 3/2 2 11 5/2 3/2-5/4 3 1 2 3/2 2 1/2

19. Wavelets: An Example 1771261015813 Now compute wavelet coefficient at top level 2 3/2 2 2 2 2 2 2 2 6 9/2 25/4 21/4 21 23 2 3/2 2 11 5/2 3/2-5/4 3 1 2 3/2 2 1/2 -1/2

20. Wavelets: An Example 11 5/2 3/2-5/4 3 1 2 3/2 2 1/2 -1/2 Can reconstruct signal top-down using only the indicated information (mean and wavelet coefficients)

21. Wavelet-Based Traffic Models n To reconstruct the time series exactly, you need to use exactly those wavelet coefficients, and the starting mean (I.e., one-to-one mapping between time series values and coefficients in the wavelet domain) n To generate something that looks like the original time series, it suffices to use Wj,k values from similar distribution

22. WIG Model n The wavelet independent Gaussian (WIG) model chooses the Wj,k’s at random from a Gaussian distribution, with a specified mean and variance at each level j of the tree (variance of the Wj,k’s at a particular level of the tree typically increases as you go down the binary tree of wavelet coefficients)

23. Wavelet-Based Traffic Modeling n In network traffic time series, the observed values are all non-negative n In wavelet terms, this constraint means the Wj,k are smaller in absolute value than the Uj,k (which themselves are always non-negative) n The WIG model does not guarantee this, and can thus generate negative values in the synthetic time series

24. Multi-Fractal Wavelet Model n The Multifractal Wavelet Model (MWM) proposed by Ribeiro et al does explicitly consider this constraint, and thus guarantees non-negative values for all observations in the generated series n Can express Wj,k = Aj,k * Uj,k where -1 <= Aj,k <= 1

25. Other Observations n For typical network traffic time series: –The mean of the Aj,k’s is zero at each level j of the binary tree of wavelet coefficients –The variance of the Aj,k’s increases as you progress down the levels of the binary tree –The Aj,k’s are uncorrelated (whether the original time series was correlated or not) –Symmetric beta distribution works well for modeling the distribution of Aj,k’s

26. Wavelet-Based Traffic Modeling n By generating random Aj,k values from a specified distribution (e.g., symmetric beta distribution), one can generate synthetic time series with desired variance (and fractal-like structure) across many time scales n Non-Gaussian marginals no problem n See example plots for LBL-TCP and Bellcore Ethernet LAN traces

27. Summary n Wavelets offer a flexible and powerful traffic modeling technique that is able to capture short-range and long-range traffic characteristics, including correlations in the time domain n Very efficient O(N) computational procedure for trace generation to generate N data points in trace