1. A Nonstationary Poisson View of Internet Traffic T. Karagiannis, M. Molle, M. Faloutsos University of California, Riverside A. Broido University of California, San Diego IEEE INFOCOM 2004 Presented by Ryan

2. Outline Introduction Background –Definitions –Previous Models Observed Behavior –A time-dependent Poisson characterization Conclusion

3. Introduction Nature of Internet Traffic –How does Internet traffic look like? Modeling of Internet Traffic –Provisioning –Resource Management –Traffic generation in simulation

4. Introduction Comparing with ten years ago –Three orders of magnitude increase in Links speed Number of hosts Number of flows –Limiting behavior of an aggregate traffic flow created by multiplexing large number of independent flows  Poisson model

5. Background – Definitions Complementary cumulative distribution function (CCDF) Autocorrelation Function (ACF) –Correlation between a time series {X t } and its k-shifted time series {X t+k } exponential distribution

6. Background – Definitions Long Range Dependence (LRD) –The sum of its autocorrelation does not converge Memory is built-in to the process

7. Background – Definitions Self-similarity –Certain properties are preserved irrespective of scaling in space or time H – Hurst exponent

8. Background – Definitions Self-similar

9. Background – Definitions Second-order self-similar –ACF is preserved irrespective of time aggregation Model LRD process H  1, the dependence is stronger

10. Background – Previous Model Telephone call arrival process (70’s – 80’s) –Poisson Model –Independent inter-arrival time Internet Traffic (90’s) –Self-similarity –Long-range dependence (LRD) –Heavy tailed distribution

11. Findings in the Paper At Sub-Second Scales –Poisson and independent packets arrival At Multi-Second Scales –Nonstationary At Larger Time Scales –Long Range Dependence

12. Traffic Traces Traces from CAIDA (primary focus) –Internet backbone, OC48 link (2.5Gbps) –August 2002, January and April 2003 Traces from WIDE –Trans-Pacific link (100Mbps) –June 2003

13. Traffic Traces BC-pAug89 and LEL-PKT-4 traces –On the Self-Similar Nature of Ethernet Traffic. (1994) W. E. Leland, M. S. Taqqu, W. Willinger, and D. V. Wilson. –Wide Area Traffic: The Failure of Poisson Modeling. (1995) V. Paxson and S. Floyd.

14. Traffic Traces Analysis of OC48 traces –The link is overprovisioned Below 24% link unilization –~90% bytes (TCP) –~95% packets (TCP)

15. Poisson at Sub-Second Time Scales Distribution of Packet Inter-arrival Times –Red line – corresponding to exponential distribution –Blue line – OC48 traces –Linear least squares fitting  99.99% confidence

16. Poisson at Sub-Second Time Scales WIDE trace LBL-PKT-4 trace

17. Poisson at Sub-Second Time Scales Independence 95% confidence interval of zero Inter-arrival Time ACF Packet Size ACF

18. Nonstationary at Multi-Second Time Scales Rate changes at second scales Changes detection –Canny Edge Detector algorithm change point

19. Nonstationary at Multi-Second Time Scales Similar in BC-pAug89 trace

20. Nonstationary at Multi-Second Time Scales Possible causes for nonstationarity –Variation of the number of active sources over time –Self-similarity in the traffic generation process –Change of routing

21. Nonstationary at Multi-Second Time Scales Characteristics of nonstationary –Magnitude of the rate change events Significant negative correlation at lag one –An increase followed by a decrease

22. Nonstationary at Multi-Second Time Scales –Duration of change free intervals Follow the exponential distribution

23. LRD at Large Time Scales Measure LRD by the Hurst exponent (H) estimators –LRD, H  1 –Point of Change (Dichotomy in scaling) Below ~ 0.6, Above ~ 0.85 Point of Change

24. LRD at Large Time Scales Effect of nonstationarity –Remove “nonstationarity” by moving average (Gaussian window) Point of Change

25. Conclusion Revisit Poisson assumption –Analyzing a combination of traces Different observations at different time scales Network Traffic –Time-dependent Poisson Backbone links only Massive scale and multiplexing –MAY lead to a simpler model

26. Background – Definitions Poisson Process –The number of arrivals occurring in two disjoint (non- overlapping) subintervals are independent random variables.disjointindependent –The probability of the number of arrivals in some subinterval [t,t + τ] is given by –The inter-arrival time is exponentially distributed