1. UNDERSTANDING PERIODICITY AND REGULARITY OF NODAL ENCOUNTERS IN MOBILE NETWORKS: A SPECTRAL ANALYSIS Sungwook Moon, Ahmed Helmy Dept. of Computer and Information Science and Engineering University of Florida 1

2. Contents 2  Introduction  Data sets  Methodology  Time Series Representation  Auto Correlation  Spectral Analysis  Periodicity in Nodal Encounter  Regular Encounters  Applications & Related Work  Conclusions & Future Work

3. Introduction  Network Environment  Mobile networks Communication via wireless signal between the mobile nodes  Basic Definitions  Mobile Nodes An entity that can move around with wireless communication devices (e.g. PDA, smartphone)  Encounter (contact) [2][3] Two mobile nodes present within the wireless communication range. (e.g. Bluetooth discovery) Encounter and contact are used interchangeably in literatures 3

4. Introduction  Assumption  Encounter in WLAN Mobile users using the same access points at the same time. Commonly used assumption in other literatures [1][3]  Bluetooth encounter Detected by Bluetooth beacon signal. 4 [1] Augustin Chaintreau, Pan Hui, Jon Crowcroft, Christophe Diot, Richard Gass, and James Scott. Impact of human mobility on the design of opportunistic forwarding algorithms. In Proc. IEEE INFOCOM, Apr 2006. [3] W. Hsu, D. Dutta, and A. Helmy. Mining behavioral groups in large wireless lans. In Proc. ACM MobiCom, Sep 2007.

5. Introduction  Motivations  Efficient and intelligent deployment of mobile networks requires deep knowledge on behavioral pattern of mobile nodes.  Yet, our understanding about the behavioral pattern of mobile nodes is mainly limited to mobility and aggregate information analysis of encounter.  Challenges  Identifying the important spaces to explore among multiple dimensions of variables to understand the behavior of mobile nodes.  Processing different forms of data sets to derive generic encounter behavior of mobile nodes. 5

6. Overview 6  Problem Statement  Can we identify encounter pattern of mobile users? What are the important dimensional spaces to explore? How to analyze periodicity of mobile encounter? Can we utilize the identified characteristics of encounter pattern?

7. Introduction 7  Encounter Pattern  Critical information for mobile networking that directly transfers data in the event of encounter. (e.g. Bluetooth data transfer between two nodes).  No need of location information.  Type of analysis  Encountered pairs (i, j) Encounter of two mobile nodes, i and j  Individual nodal encounter Aggregate encounter information for each mobile node

8. Data Sets Trace SourceTrace DurationAnalyzed Duration Collecting Devices Encounter Pairs USC2006 Jan-May 2007 Jan-May 2008 Jan-May 128 days28,173 35,274 42,587 25,359,454 19,057,089 31,289,100 UF2007 Aug-Dec 2008 Jan-May 128 days46,115 50,549 12,493,403 16,807,427 Montreal2004 Aug-Dec128 days4552,512 Bluetooth2008 Feb-Mar 2008 Nov 256 hours10 27 1,277 1,655 8

9. Data Sets 9  Example trace format  Processed WLAN trace format  Encounter trace format for pair (i, j) MAC *APStartDuration 00:aa:bb:3a:4b:5clbw343-win-ap1200-112018894741200 MAC (i)MAC (j)StartDuration 00:aa:bb:3a:4b:5c3c:5a:4b:de:a2:f41201889474500 * MAC address is anonymized before processing.

10. Contents 10  Introduction  Data sets  Methodology  Time Series Representation  Auto Correlation  Spectral Analysis  Periodicity in Nodal Encounter  Regular Encounters  Applications & Related Work  Conclusions & Future Work

11. Periodicity  Methodology  Transform a variety of network traces to encounter trace in a form of time series data.  Analyze periodicity by applying power spectral analysis (autocorrelation(ACF) + Fourier transform).  Practice of power spectral analysis Analysis of stock market [7] Analysis of Network traffic [4] 11 [4] Alefiya Hussain, John Heidemann, and Christos Papadopoulos. Identification of repeated denial of service attacks. In Proc. IEEE INFOCOM, Apr 2006. [7] C. Chatfield. Analysis of Time Series, pages 18–24, 105–134. Chapman and Hall, 1989.

12. Periodicity  Time Domain Representation of Encountered Pattern  Daily encounter Binary process, = 1, for each encounter count on time d, where d = day (1,2,…T); otherwise = 0  In our extended report, we analyze about the encounter frequency and encounter duration as well.  Example time series data of daily encounter for an encounter pair (i, j) 12 * Sungwook Moon and Ahmed Helmy. Understanding periodicity and regularity of nodal encounters in mobile networks. Technical report, Aug 2010, arxXv:1004.4437. 0 1 d (days) 1285215472

13. Periodicity 13  Example time series data of daily encounter for an encountered pair (i, j) 0 1 d (days)1285215472

14. Periodicity 14  Daily encounter rate  Let be a daily encounter for a pair (i, j), such that where T is the observed period.  Analyzing by the encounter rate  Rarely encountering pattern takes up majority of encounter pairs; thus, may hinder other patterns in overall observation if analyzed together.  Therefore, we analyze the encounter pairs by the groups of different encounter rate. Rarely encountering pairs: (0.1 ≤ D rate < 0.2) Frequently encountering pairs: (0.5 ≤ D rate < 0.6)

15.  Auto Correlation Function (ACF)  Apply ACF to the time-domain representation of encounter data to find repetitive patterns.  ACF (Auto Correlation Function): a measure of how similar the stream of data is to itself shifted in time by lag k. k: lag, d: day; T: overall time; λ: avg. encounter rate Periodicity 15

16. Periodicity (encounter pairs) 16  Various encounter pattern is showing but weekly encounter pattern (lag = 7) shows the strongest pattern.  Some of other lags (i.e. lag =14 and 21) are artifacts of a smaller lag (i.e. lag=7) Figure. Autocorrelation coefficient for each lag at USC encounter trace.

17. Periodicity  Conversion to frequency domain representation  Converting from time domain to frequency domain shows dominant repetitive pattern more clearly while filtering out the artifacts.  Apply Fourier transform to convert time series data to the frequency domain. c: frequency component 17

18. Periodicity 18  Frequency domain graph  X axis: frequency component number of replicas over the observed period of time e.g. peak observed at 18 of the X-axis indicates that certain pattern has repeated for 18 times over the observed period of time (128 days).  Y axis: normalized frequency magnitude in probability density.

19. Contents 19  Introduction  Data sets  Methodology  Time Series Representation  Auto Correlation  Spectral Analysis  Periodicity in Nodal Encounter  Regular Encounters  Applications & Related Work  Conclusions & Future Work

20. Periodicity (encounter pairs) 20  Weekly encounter pattern is very strong. (see around 18 at frequency component) Figure. Normalized frequency magnitude for the rarely encountering pairs (0.1 ≤ D rate < 0.2) 18

21. Periodicity (encounter pairs) 21 Figure. Normalized frequency magnitude for the frequently encountering pairs (0.5 ≤ D rate < 0.6)  Weekly encounter pattern is still strong but weaker than rarely encountering pairs.  This frequency of different periodicities can be used for profiling mobile nodes.

22. Periodicity (individual node) 22  Weekly encounter pattern is stronger than encounter pairs. (see around 18 at frequency component) Figure. Normalized frequency magnitude for the rarely encountering nodes (0.1 ≤ D rate < 0.2)

23. Periodicity (individual node) 23  Weekly encounter pattern is stronger than encounter pairs. (see around 18 at frequency component) Figure. Normalized frequency magnitude for the frequently encountering nodes (0.5 ≤ D rate < 0.6)

24. Periodicity (individual node) 24  Bluetooth Encounter  Daily encounter pattern is observed. Figure. Individual Bluetooth encounter pattern for the encountered pairs at UF Bluetooth trace (hourly encounter rate)

25. Contents 25  Introduction  Data sets  Methodology  Time Series Representation  Auto Correlation  Spectral Analysis  Periodicity in Nodal Encounter  Regular Encounters  Applications & Related Work  Conclusions & Future Work

26. Regularity  Preliminary investigation.  Utilize periodic properties of encounter pairs.  Regular encounter pattern is stable and consistent pattern over the period of observed time.  E.g. consistent repetition of certain pattern over time.  Discover the pairs showing regular encounter pattern from the periodicity analysis.  Trace analyzed: USC 2006 spring 26 0 1 d (days) 128

27. Regularity  Knee appears in the 0.8 area  Approaches to find regularly encountering pairs:  If peak frequency magnitude is in the top 20% in the group.  Regularly encountering pairs show distinctly stronger periodicity with higher frequency magnitude for their top frequency component. 27  Figure. Empirical CDF of the top peaks by daily encounter rate USC 2006 trace

28. Regularity  Empirical heuristic approaches (preliminary)  Approach #1: Extracting regularly encountering pairs. Choose the pairs whose peak frequency magnitude (top peak) is in the top 20% for peak frequency magnitude of all the pairs. Max 1 = max( ) ≥ θ, where θ is threshold for the top 20 % peak frequency magnitude where  Approach #2: Extracting regularly encountering pairs. Pick top three magnitudes whose sum of frequency magnitudes takes over 30% of overall sum of frequency magnitudes. Max 1 + Max2+Max3 ≥ 0.3 * sum( ), where 28

29. Regularity 29  Behavioral pattern of regularly encountering pairs (on-going investigation )  Different location access pattern is observed among regularly encounter pairs and normal pairs.  Each of approach #1 and #2 show similar location access pattern.  Figure. Location (AP) access preference by general pairs vs regular pairs (approach #1 = top 20 percent, approach #2 = top 3 frequency magnitudes)

30. Contents 30  Introduction  Data sets  Methodology  Time Series Representation  Auto Correlation  Spectral Analysis  Periodicity in Nodal Encounter  Regular Encounters  Applications & Related Work  Conclusions & Future Work

31. Application 31  Develop realistic encounter model.  Profiling mobile nodes based on periodic property and embed profile to simulated node or robot node to emulate human behavior. * * Sungwook Moon and Ahmed Helmy. Mobile Testbeds with an Attitude. IEEE GlobeCom, Demo session, Dec 2010.

32. Application 32  Classify the mobile users by regularity to create a stable overlay networks. A D B C E F ε (BD) ε (BE) ε (EF) ε (BC) ε (AB) ε (AC) ε (CD) ε (CF) Regular encounter Non-Regular encounter ε: regularity metric

33. Related Work 33  Periodicity  Spectral analysis is used in network traffic analysis to discover similar footprints of DDOS attack. [4]  Periodicity study for activities at APs discovers strong periodicity from aggregate APs access pattern and mobility diameter of mobile nodes. [5] [4] Alefiya Hussain, John Heidemann, and Christos Papadopoulos. Identification of repeated denial of service attacks. In Proc. IEEE INFOCOM, Apr 2006. [5] Minkyong Kim and David F. Kotz. Periodic properties of user mobility and access- point popularity. Personal and Ubiquitous Computing, Springer-Verlag, 11, Aug 2007. Our work is unique in that we use spectral analysis to analyze encounter pairs and individual encounter pattern.

34. Related Work 34  Encounter: Inter-contact time follows power- law distribution from an analysis of 200 mobile users. [2]  Regularity: Researchers indicate that discovering regular pattern can be useful in predicting behaviors to help routing decision. [6] [2] Thomas Karagiannis, Jean-Yves Le Boudec, and Milan Vojnovic. Power law and exponential decay of inter contact times between mobile devices. In Proc. ACM MobiCom, Sep 2007. [6] Pan Hui and Jon Crowcroft. Human mobility models and opportunistic communication system design. Royal Society Philosophical Transactions, (366):1872, Jun 2008. We analyze the extensive network trace with diverse set of mobile users. Our regularity analysis can help to make an informed decision in predicting encounter behavior.

35. Contents 35  Introduction  Data sets  Methodology  Time Series Representation  Auto Correlation  Spectral Analysis  Periodicity in Nodal Encounter  Regular Encounters  Applications & Related Work  Conclusions & Future Work

36. Conclusions 36  Contribution  Analyze the encounter pattern for extensive network traces for more than 50,000 mobile users and find mathematical methodology to study periodicity of encounter pattern.  Observe strong periodicity, particularly weekly encounter pattern, for rarely encountering pairs and individual encounter pattern.  Propose two empirical heuristic approaches to discover regularly encounter pattern, and discover regularly encountering pairs show different location visiting behavior than normal pairs.

37. Future Work  Analyze periodicity of inter-contact time and location access pattern.  Investigation and validation of the methods to discover regular encounter pattern on the diverse set of traces.  Classifying the encountered pairs by periodicity to use in profiling and modeling encounter pattern. 37

38. References 38 [1] Augustin Chaintreau, Pan Hui, Jon Crowcroft, Christophe Diot, Richard Gass, and James Scott. Impact of human mobility on the design of opportunistic forwarding algorithms. In Proc. IEEE INFOCOM, Apr 2006. [2] Thomas Karagiannis, Jean-Yves Le Boudec, and Milan Vojnovic. Power law and exponential decay of inter contact times between mobile devices. In Proc. ACM MobiCom, Sep 2007. [3] W. Hsu, D. Dutta, and A. Helmy. Mining behavioral groups in large wireless lans. In Proc. ACM MobiCom, Sep 2007. [4] Alefiya Hussain, John Heidemann, and Christos Papadopoulos. Identification of repeated denial of service attacks. In Proc. IEEE INFOCOM, Apr 2006. [5] Minkyong Kim and David F. Kotz. Periodic properties of user mobility and access-point popularity. Personal and Ubiquitous Computing, Springer-Verlag, 11, Aug 2007. [6] Pan Hui and Jon Crowcroft. Human mobility models and opportunistic communication system design. Royal Society Philosophical Transactions, (366):1872, Jun 2008. [7] C. Chatfield. Analysis of Time Series, pages 18–24, 105–134. Chapman and Hall, 1989. [8] Sungwook Moon and Ahmed Helmy. Understanding periodicity and regularity of nodal encounters in mobile networks. Technical report, Aug 2010, arxXv:1004.4437. [9] Sungwook Moon and Ahmed Helmy. Mobile Testbeds with an Attitude. IEEE GlobeCom, Demo session, Dec 2010.

39. Questions  Thank you. 39