Mean-variance relationship of the number of flows in traffic aggregation and its application to traffic management

Authors:
Ryoichi Kawahara;Tetsuya Takine;Tatsuya Mori;Noriaki Kamiyama;Keisuke Ishibashi
Affiliations:
NTT Network Technology Laboratories, NTT Corporation, 3-9-11 Midori-cho, Musashino-shi, Tokyo 180-8585, Japan;Department of Information and Communications Technology, Graduate School of Engineering, Osaka University, Suita 565-0871, Japan;NTT Network Technology Laboratories, NTT Corporation, 3-9-11 Midori-cho, Musashino-shi, Tokyo 180-8585, Japan;NTT Network Technology Laboratories, NTT Corporation, 3-9-11 Midori-cho, Musashino-shi, Tokyo 180-8585, Japan;NTT Network Technology Laboratories, NTT Corporation, 3-9-11 Midori-cho, Musashino-shi, Tokyo 180-8585, Japan
Venue:
Computer Networks: The International Journal of Computer and Telecommunications Networking
Year:
2013

Citing 16
Cited 0

A signal analysis of network traffic anomalies

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
Properties and prediction of flow statistics from sampled packet streams

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice

ACM Transactions on Computer Systems (TOCS)
Estimating flow distributions from sampled flow statistics

Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Sketch-based change detection: methods, evaluation, and applications

Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Traffic matrix estimation on a large IP backbone: a comparison on real data

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Characterization of network-wide anomalies in traffic flows

Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Aberrant Behavior Detection in Time Series for Network Monitoring

LISA '00 Proceedings of the 14th USENIX conference on System administration
Mining anomalies using traffic feature distributions

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Impact of packet sampling on anomaly detection metrics

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Is sampled data sufficient for anomaly detection?

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Inferring Original Traffic Pattern from Sampled Flow Statistics

SAINT-W '07 Proceedings of the 2007 International Symposium on Applications and the Internet Workshops
Towards optimal sampling for flow size estimation

Proceedings of the 8th ACM SIGCOMM conference on Internet measurement
Monitoring the application-layer DDoS attacks for popular websites

IEEE/ACM Transactions on Networking (TON)
Internet inter-domain traffic

Proceedings of the ACM SIGCOMM 2010 conference
Detection accuracy of network anomalies using sampled flow statistics

International Journal of Network Management

Quantified Score

Hi-index	0.00

Visualization

Abstract

We consider the mean-variance relationship of the number of flows in traffic aggregation, where flows are divided into several groups randomly, based on a predefined flow aggregation index, such as source IP address. We first derive a quadratic relationship between the mean and the variance of the number of flows belonging to a randomly chosen traffic aggregation group. Note here that the result is applicable to sampled flows obtained through packet sampling. We then show that our analytically derived mean-variance relationship fits well those in actual packet trace data sets. Next, we present two applications of the mean-variance relationship to traffic management. One is an application to detecting network anomalies through monitoring a time series of traffic. Using the mean-variance relationship, we determine the traffic aggregation level in traffic monitoring so that it meets two predefined requirements on false positive and false negative ratios simultaneously. The other is an application to load balancing among network equipments that require per-flow management. We utilize the mean-variance relationship for estimating the processing capability required in each network equipment.