Inferring Original Traffic Pattern from Sampled Flow Statistics

Authors:
Tatsuya Mori;Ryoichi Kawahara;Noriaki Kamiyama;Shigeaki Harada
Affiliations:
NTT Corporation, Japan;NTT Corporation, Japan;NTT Corporation, Japan;NTT Corporation, Japan
Venue:
SAINT-W '07 Proceedings of the 2007 International Symposium on Applications and the Internet Workshops
Year:
2007

Citing 0
Cited 2

Detection accuracy of network anomalies using sampled flow statistics

International Journal of Network Management
Mean-variance relationship of the number of flows in traffic aggregation and its application to traffic management

Computer Networks: The International Journal of Computer and Telecommunications Networking

Quantified Score

Hi-index	0.00

Visualization

Abstract

Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.