1960 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL ...alexliu/publications/M2M/M2M_ton_NJU.pdfdevices...

1960 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL. 21, NO. 6, DECEMBER 2013

Large-Scale Measurement and Characterization ofCellular Machine-to-Machine Traffic

M. Zubair Shafiq, Lusheng Ji, Senior Member, IEEE, Alex X. Liu, Jeffrey Pang, and Jia Wang

Abstract—Cellular network-based machine-to-machine (M2M)communication is fast becoming a market-changing force for awide spectrum of businesses and applications such as telematics,smartmetering, point-of-sale terminals, and home security and au-tomation systems. In this paper, we aim to answer the followingimportant question: Does traffic generated by M2M devices im-pose new requirements and challenges for cellular network de-sign and management? To answer this question, we take a firstlook at the characteristics of M2M traffic and compare it to tra-ditional smartphone traffic. We have conducted our measurementanalysis using a week-long traffic trace collected from a tier-1 cel-lular network in the US. We characterize M2M traffic from a widerange of perspectives, including temporal dynamics, device mo-bility, application usage, and network performance. Our exper-imental results show that M2M traffic exhibits significantly dif-ferent patterns than smartphone traffic in multiple aspects. For in-stance, M2M devices have a much larger ratio of uplink-to-down-link traffic volume, their traffic typically exhibits different diurnalpatterns, they are more likely to generate synchronized traffic re-sulting in bursty aggregate traffic volumes, and are less mobilecompared to smartphones. On the other hand, we also find thatM2M devices are generally competing with smartphones for net-work resources in co-located geographical regions. These and otherfindings suggest that better protocol design, more careful spectrumallocation, and modified pricing schemes may be needed to accom-modate the rise of M2M devices.

Index Terms—Cellular networks, machine-to-machine (M2M),measurement, mobility, network performance, performanceevaluation.

I. INTRODUCTION

S MART devices that function without direct human in-tervention are rapidly becoming an integral part of our

lives. Such devices are increasingly used in applicationssuch as telehealth, shipping and logistics, utility and environ-mental monitoring, industrial automation, and asset tracking.

Manuscript received April 26, 2012; revised September 06, 2012 andDecember 08, 2012; accepted December 28, 2012; approved by IEEE/ACMTRANSACTIONS ON NETWORKING Editor T. Karagiannis. Date of publicationJuly 16, 2013; date of current version December 13, 2013. The preliminaryversion of this paper, titled “A First Look at Cellular Machine-to-MachineTraffic-Large Scale Measurement and Characterization,” was published inthe Proceedings of the ACM International Conference on Measurement andModeling of Computer Systems (SIGMETRICS/Performance), London, U.K.,June 2012. (Corresponding author: A. X. Liu)M. Z. Shafiq is with the Department of Computer Science and Engi-

neering, Michigan State University, East Lansing, MI 48824 USA (e-mail:[email protected]).L. Ji, J. Pang, and J. Wang are with AT&T Labs—Research, Florham Park,

NJ 07932 USA (e-mail: [email protected]; [email protected];[email protected]).A. X. Liu is with the Department of Computer Science and Technology, Nan-

jing University, Nanjing 210093, China (e-mail: [email protected]).Color versions of one or more of the figures in this paper are available online

at http://ieeexplore.ieee.org.Digital Object Identifier 10.1109/TNET.2013.2256431

Compared to traditional automation technologies, one majordifference for this new generation of smart devices is howtightly they are coupled into larger-scale service infrastruc-tures. For example, in logistic operations, the locations of fleetvehicles can be tracked with automatic vehicle location (AVL)devices such as the CalAmp LMU-2600 [6] and uploadedinto back-end automatic dispatching and planning systems forreal-time global fleet management. More and more emergingtechnologies also heavily depend on these smart devices. Forinstance, a cornerstone for the Smart Grid Initiative is the capa-bility of receiving and controlling individual customer’s powerusage on a real-time and wide-area basis through devices suchas the electric meters equipped with Trilliant CellReader [24]modules.This kind of leap in technology would not be possible without

the support of wide area wireless communication infrastructure,in particular cellular data networks. It is estimated that there arealready tens of millions of such smart devices connected to cel-lular networks worldwide, and within the next 3–5 years, thisnumber will grow to hundreds of millions [2], [3]. This repre-sents a substantial growth opportunity for cellular operators asthe increase in mobile phone penetration rate is flattening in thedeveloped world [11], [25].M2M devices and smartphones share the same network in-

frastructure, but current cellular data networks are primarily de-signed, engineered, and managed for smartphone usage. Giventhat the population of cellular M2M devices may soon eclipsethat of smartphones, a logical question to ask is the following:What are the challenges that cellular network operators mayface in trying to accommodate traffic from both smartphonesand M2M devices? Existing configurations may not be opti-mized to support M2M devices. In addition, M2M devices maycompete with smartphones and impose new demand on sharedresources. Hence, to answer this question, it is crucial to un-derstand M2M traffic patterns and how they are different fromtraditional smartphone traffic. The knowledge of traffic patternscan reveal insights for better management of shared networkresources and ensuring best service quality for both types ofdevices.In this paper, we take a first look at M2M traffic on a commer-

cial cellular network. Our goal is to understand the characteris-tics of M2M traffic, in particular, whether and how they differfrom those of smartphones. To the best of our knowledge, ourstudy is the first to investigate the characteristics of traffic gen-erated by M2M devices. We summarize our key contributionsas follows.• Large-scale measurement:We conduct the first large-scalemeasurement study of cellular M2M traffic. For our study,we have collected anonymized IP-level traffic traces fromthe core network of a tier-1 cellular network in the US. This

1063-6692 © 2013 IEEE

SHAFIQ et al.: LARGE-SCALE MEASUREMENT AND CHARACTERIZATION OF CELLULAR MACHINE-TO-MACHINE TRAFFIC 1961

trace covers all states in the US during one week in August2010. This trace contains M2M traffic from millions ofdevices belonging to more than 150 hardware models. Inaddition, we have also collected anonymized traffic tracesfrom millions of smartphones from the same cellular net-work. Overall, we find that M2M devices generate sig-nificantly less traffic compared to smartphones. Further-more, in our trace, we observe that the number of M2Mdevices is also significantly smaller than the number ofsmartphones. However, the number of new M2M devicesand their total traffic volume is increasing at a very rapidpace. In fact, a longitudinal comparison of M2M traffic inthis cellular network showed that total M2M traffic volumehas increased more than 250% in 2011 since the previousyear. In comparison, Cisco reported that mobile data trafficgrew “only” 132% in 2011, which is almost half of the in-crease observed for M2M traffic [4]. Consequently, it isimportant to understand the peculiarities of M2M traffic,especially its contrast to the traditional smartphone traffic,for future network engineering. In this study, we compareM2M and smartphone traffic in the following aspects: ag-gregate volume, volume time series, sessions, mobility, ap-plications, and network performance.

• Aggregate traffic volume: We jointly study the distribu-tions of aggregate uplink and downlink traffic volume. Ourmajor finding is that, though M2M devices do not gen-erate as much traffic as smartphones, they have a muchlarger ratio of uplink to downlink traffic volume comparedto smartphones. Since existing cellular data protocols sup-port higher capacity in the downlink than the uplink, ourfinding suggests that network operators need careful spec-trum allocation and management to avoid contention be-tween low-volume, uplink-heavy M2M traffic and high-volume, downlink-heavy smartphone traffic.

• Traffic volume time series: We analyze the traffic volumetime series of M2M devices and smartphones. Our anal-ysis shows that different M2M device models exhibit dif-ferent diurnal behaviors than smartphones. However, someM2M device models do share similar peak hours as smart-phones. Hence, M2M traffic imposes new requirements onthe shared network resources that need to be considered incapacity planning, where network is usually provisionedaccording to peak usage. Another finding from time seriesanalysis is that some M2M device models generate trafficin a synchronized fashion (like a botnet [23]), which canresult in denial of service due to limited radio spectrum.Therefore,M2M protocols should randomize such networkusage to avoid congesting the radio network.

• Traffic sessions: To understand the usage behavior of in-dividual devices, we conduct session-level traffic analysisin terms of active time, session length, and session inter-arrival time. We find that high traffic volume does not al-ways correlate with more active time. This finding calls fornew billing schemes, which go beyond per-byte chargingmodels. We also find that M2M devices have different ses-sion length and interarrival time characteristics comparedto smartphones. This finding can be utilized by device man-ufacturers to improve battery management and by networkoperators to optimize radio network parameters for M2Mdevices.

• Device mobility: We compare the mobility characteristicsof M2M devices and smartphones from both device andnetwork perspectives. We find that M2M devices, with afew exceptions, are less mobile than smartphones. We alsofind that M2M and smartphone traffic compete for net-work resources in co-located geographical regions. Thisfinding indicates that careful network resource allocationis required to avoid contention between low-volume M2Mtraffic and high-volume smartphone traffic.

• Application usage: We also study the contribution of dif-ferent applications to the aggregate traffic volume of M2Mdevices and smartphones. We find that M2M traffic mostlyuses custom application protocols for specific needs, whichis undesirable because it is difficult for network operatorsto understand and mitigate adverse effects from these pro-tocols compared to standard protocols.

• Network performance: The network performance resultsof M2M traffic, in terms of packet loss ratio and round-triptime, show strong dependency on device radio technology(2G or 3G) and expected device environment (e.g., indoorsversus outdoors). This implies that network operators willneed to be cognizant of a large population of M2M deviceson legacy networks even as they reprovision spectrum for4G technologies to support newer smartphones.

The rest of this paper proceeds as follows. We first providedetails of our collected trace in Section II. Sections III–VIIIpresent measurement analysis of M2M and smartphone traffic.Finally, we conclude in Section IX.

II. DATA

A. Data Set

The data used in this study is collected from a nationwidecellular network operator in the US that provides 2G and 3Gcellular data services. It supports GPRS, EDGE, UMTS, andHSPA technologies. Architecturally, the portion of its networkthat supports cellular data service is organized in two tiers. Thelower tier, the radio access network, provides wireless connec-tivity to user devices, and the upper tier, the core network, inter-faces the cellular data network with the Internet. More detailsabout cellular data network architecture can be found in [21].The data collection apparatus that produced the trace used in

our study is deployed at all links between serving gateway sup-port nodes (SGSN) and gateway GRPS support nodes (GGSN)in the core network. This apparatus is capable of anonymouslylogging session level traffic information at 5-min intervals forall IP data traffic between cellular devices and the Internet. Inother words, each record in the trace is a 5-min traffic volume(i.e., TCP payload size in bytes) summary aggregated by uniquedevice identifier and application category. Each record also con-tains the cell location of the device at the start of the session.Each record is originally timestamped according to the standardcoordinated universal time (UTC), which is then converted tothe local time at the device for our analysis. This trace was col-lected during one complete week in August 2010. Geograph-ically, the trace covers the whole US. Applications are identi-fied using a combination of port information, HTTP host anduser-agent information, and other heuristics. Overall, traffic isclassified into the following 17 categories:1) ;


2) ;3) ;4) ;5) ;6) ;7) ;8) ;9) ;10) ;11) ;12) ;13) ;14) ;15) ;16) ;17) .POP3 and IMAP traffic are classified as e-mail. Additional con-trol channel information is used to identify traffic. MostHTTP traffic is classified as or based onMIMEtype. Some heuristics are employed to identify non-HTTPtraffic. Gnutella and BitTorrent tracker-based HTTP traffic isalso labeled . User-agent information is used to identifyspecific mobile app traffic such as . Port number in-formation is used to identify other traffic classes. Many lowvolume applications are jointly labeled as . Theremaining unclassified traffic is labeled as . More in-formation about application classification can be found in [10]and [20].

B. M2M Device Categorization

The data set contains traffic records for all cellular devices,so we first need to separate M2M devices from the rest. Further-more, because M2M devices are usually developed for specificapplications, significant behavioral differences are expected be-tween M2M devices for different target applications. Thus, itis reasonable to subdivide M2M devices into categories basedon their intended application to better understand the uniquetraffic characteristics of different M2M categories. We start thisprocess by identifying the hardware model of each cellular de-vice using the device’s Type Allocation Code (TAC), which ispart of the unique identifier of each cellular device. Althoughthe records in our data set are anonymized, the TAC portion ofthe unique identifier is retained. Thus, the hardware model ofeach cellular device is obtained by consulting the TAC databaseof the GSM Association.Because there is no rigorous definition for M2M devices or

standard ways for determining their application categories, andmany devices have multiple uses, knowing the device model isnot sufficient for identifying a device with certainty as an M2Mdevice nor for identifying its M2M category. Toward this end,we adopt the device classification scheme of a major cellularservice provider as a base template for categorizing M2M de-vices [1]. To supplement and verify this template, we also usepublic information such as production brochures and specifica-tion sheets. In total, we have classified more than 150 devicemodels as M2M devices, and further divide them into the fol-lowing six categories.1) Asset tracking: These M2M devices are used to remotelytrack objects like cargo containers and other shipments.These devices are often coupled with other sensors for

tasks like temperature and pressure measurement. In ourtrace, about 18% devices belong to this category.

2) Building security: These M2M devices are typically usedto manage door access and security cameras. In our trace,about 14% devices belong to this category.

3) Fleet: These M2M devices are used to monitor vehiclelocations, arrivals, and departures and provide real-timeaccess to critical operational data for logistic serviceproviders. In our trace, about 51% devices belong to thiscategory.

4) Miscellaneous (Misc.): These M2M devices are genericcellular communication modems with embedded systemdata input and output ports such as serial, I2C, analog, anddigital. They provide network connectivity for customizedsolutions. In our trace, about 9% devices belong to thiscategory.

5) Metering: These M2M devices are mostly used for re-mote measurement and monitoring in agricultural, envi-ronmental, and energy applications. In our trace, about 6%devices belong to this category.

6) Telehealth:TheseM2Mdevices aremostly used for remotemeasurement and monitoring in healthcare applications. Inour trace, about 2% devices belong to this category.

We acknowledge that due to lack of more detailed usage in-formation and ambiguity in device registry databases, our clas-sification may contain some errors. To limit such errors, we tryto be as conservative as possible when deciding whether to in-clude an M2M device model in our study. For example, cellularrouters are generally excluded from this study because the ac-tual end devices behind these routers cannot be identified. Forcellular modems and modules, we exclude models with data in-terfaces likely used by modern-day computers such as USB,PCI Express, and miniPCI, but keep those with UART, SPI,and I2C interfaces. Note that we may miss some M2M devicesin our analysis that are not active, and hence they do not ap-pear in our trace. For the sake of comparing M2M and typicalhuman-generated traffic characteristics, we have also includedin our study traffic records from a uniformly sampled set ofsmartphone models, covering millions of smartphone devices.

C. Data Set Characteristics

Given the device categorization, we now investigate thefollowing two basic characteristics of devices in our data set.First, we plot the cumulative distribution functions (CDFs) ofrecord counts for smartphone and M2M devices in Fig. 1(a).Note that “M2M” is the weighted average of the aforemen-tioned six M2M device categories. We observe that M2Mdevices have lesser number of records as compared to smart-phones. We note that about 40% of M2M devices have less than100 records in our trace, while this number is up to 1000 forsmartphones. We also observe diversity across different M2Mdevice categories. Asset tracking, fleet, and misc. devices havesignificantly more records as compared to building, metering,and telehealth devices. M2M devices may have lesser numberof records as compared to smartphones because they often haveone-off appearance in our trace. Second, to rule out the one-offappearance hypothesis, we plot the probability distributionfunctions (PDFs) of the number of unique days smartphone andM2M devices appear in our trace in Fig. 1(b). We observe somedifferences across M2M device categories. However, overall


Fig. 1. Distributions of record count and number of unique days that devicesappear in our trace. (a) # records. (b) # unique days.

M2M and smartphones both have the most fraction of devicesthat appear on all days of the week in our trace. Therefore,we can conclude that differences observed in Fig. 1(a) arenot simply because M2M devices appear sporadically in ourtrace. The observations from these two plots provide us a firstevidence of difference in network activity of smartphone andM2M devices and across M2M device categories.In the following sections, we conduct a detailed analysis and

comparison of M2M and smartphone traffic characteristics inour data set. The traffic characteristics analyzed in this paperinclude aggregate data volume, volume time series, sessionanalysis, mobility, application usage, and network performance.Note that some results presented in this paper are normalizedby dividing with an arbitrary constant for proprietary reasons.However, normalization does not change the range of themetrics used in this study. Furthermore, the missing informa-tion due to normalization does not affect the understanding ofour analysis. These characteristics are discussed in separatesections.

III. AGGREGATE TRAFFIC VOLUME

When a new technology emerges and it has to share resourceswith existing parties, a natural first question is the level of com-petition and how different parties can better coexist. This iswhy we first study and compare the distribution of aggregatetraffic volume for M2M devices and smartphones. Moreover,we also investigate whether the long established perception oftraffic volume being downlink heavy remains true for M2Mdevices [16].Fig. 2 shows the CDFs of downlink and uplink normalized

traffic volume for M2M devices and smartphones separately.The normalized traffic volume ranges between 1 (about 1 kB)and 4 (maximum volume for M2M devices). For M2M, weshow both the distributions for allM2M devices together and foreach M2M category. We first notice that different device cate-gories exhibit strong diversity in aggregate downlink and uplinktraffic volume distributions. However, we do observe a consis-tent relative ordering of CDFs for different device categories.

Fig. 2. CDFs of aggregate downlink and uplink traffic volume. (a) Downlink.(b) Uplink. (c) Ratio: log(Uplink/Downlink).

We note that the average downlink and uplink traffic volume forsmartphones is about two orders of magnitude larger comparedto all M2M device categories. Within M2M device categories,misc. category has the largest downlink traffic volume, followedby asset category, whereas building security and fleet categorieshave the smallest downlink traffic volume. A similar ordering isalso observed for uplink traffic volume.We now study the distribution of ratios of uplink traffic

volume to downlink traffic volume. For the sake of clarity, weplot the ratios after taking their logarithm, denoted by . Thepositive values of represent more uplink traffic volume thandownlink traffic volume, and its negative values represent moredownlink traffic volume than uplink traffic volume. It is notsurprising that approximately 80% of smartphone devices have

, thereby indicating larger downlink traffic volumes.However, this trend is reversed by large margin for all M2Mdevice categories, which all have 80% for more than 80% ofdevices indicating larger uplink traffic volumes. This findingprovides another evidence that M2M traffic has significantlydifferent characteristics compared to traditional smartphonetraffic. Comparing different M2M device categories, we ob-serve that building and metering categories have the lowestaverage values, whereas asset and telehealth have the highestaverage values. Such differences provide insight into thefunctionality of M2M device categories.Summary: Overall, the average per-device traffic volume

of M2M devices is much smaller than that of smartphones.However, the strength of M2M devices is really in the size oftheir population. As M2M population continues to increase,how network operators efficiently support a large number


Fig. 3. Downlink and uplink traffic volume time series. (a) Smartphone. (b) M2M. (c) Asset. (d) Building. (e) Fleet. (f) Misc. (g) Metering. (h) Telehealth.

of low volume devices will become an important issue. Ourfinding that M2M traffic has more uplink volume than downlinkvolume shows that M2M devices act more as “content pro-ducers” than “content consumers.” Interestingly, this differencecoincides with the paradigm shift in Web and mobile com-puting toward user-centric content generation. The momentumof such a shift may eventually question the assumptions foroptimization approaches exploiting downlink asymmetry ofnetwork traffic [14].

IV. TRAFFIC VOLUME TIME SERIES

Having gained an understanding of aggregated M2M trafficvolume, we next study the temporal dynamics of M2M trafficvolume. It would be interesting to know whether M2M de-vices exhibit similar daily diurnal pattern as smartphones. Oneparticular use of such information is to evaluate the potentialbenefits of incentive programs such as billing discounts en-couraging non-peak-time usage. This information can also beutilized to group devices into separate clusters with differentbilling schemes. Time series analysis is also helpful for gaininginsights into the operations of M2M devices.As mentioned in Section II, the logged traffic records con-

tain timestamps at 5-min time resolution. Therefore, we canseparately construct averaged traffic volume time series forsmartphones and all M2M device categories. We plot theseaveraged uplink and downlink traffic volume time series in

Fig. 3. While the daily diurnal pattern is evident for both M2Mand smartphone traffic, the comparison of Fig. 3(a) and (b)reveals the following two interesting differences. First, thevolume of downlink traffic dominates that of uplink traffic forsmartphones, whereas these are relatively same in M2M traffictime series. This finding follows our earlier observations inSection III. Second, we also observe that peaks in smartphonetraffic time series are wider, starting in the morning and pro-longing up to midnight, whereas peaks in M2M traffic timeseries are narrower, ending by the evening time; M2M trafficvolume exhibits significant reduction during weekend com-pared to weekdays, while smartphone traffic volume remainsvirtually unchanged. It appears that smartphone traffic timeseries is coupled with human “waking” hours, while M2Mtraffic time series is coupled with human “working” hours.This is a strong indication that currently a majority of M2Mdevices are employed for business use. They are not yet in themainstream for residential users, or as tightly integrated intopeople’s daily life as smartphones.We have also separately plotted averaged uplink and down-

link traffic volume time series for all M2M device categoriesin Fig. 3(c)–(h). We observe strong diurnal variations for allM2M device categories. However, the weekday–weekend pat-tern comparison reveals different results for most M2M cate-gories, illustrating that M2M categories indeed behave vastlydifferently from each other due to the different applications they


Fig. 4. Periodograms containing power spectral density estimate of trafficvolume time series. (a) Downlink. (b) Uplink.

serve. The previously mentioned association of M2M traffictime series with daily business activity cycle is highlighted themost by Fig. 3(d) (Building), where each working day patterndisplays not only elevated volume during working hours, butalso two peaks that in time coincide with the beginning and theend of typical business hours. Contrastingly, we see that thereis virtually no difference in traffic volume for the metering cat-egory for different days.Frequency Analysis: On a finer scale, we observe repetitive

spikes in time series of most M2M device categories. To inves-tigate these high frequency spikes in more detail, we plot theperiodograms of some downlink and uplink traffic volume timeseries in Fig. 4(a) and (b), respectively. The periodogram is anestimate of power spectral density, or frequency spectrum, of agiven signal and is defined as

where is the frequency in hertz, is the total number ofsignal samples, and is the sampling frequency [22]. In thisstudy, we have min and . The -axis inFig. 4 represents time period on logarithm scale, and -axisrepresents power in decibels (dB) for each frequency. We ob-serve distinct spikes in the periodograms corresponding to mul-tiple time periods, e.g., 1 h, 30 min, and 15 min, strongly sug-gesting the timer-driven nature of many M2M operations. Theperfect alignment of the spikes in Fig. 3(f) and (g) to one-, half-,and quarter-hour marks in time also suggests that these timersare highly synchronized. Such synchronized communication bylarge number of devices is highly undesirable both for the M2Mapplication service providers and cellular network operators be-cause it may create disruptive congestion at various locations inthe infrastructure [23]. It is noteworthy that such subhour fre-quency components are absent for smartphone traffic time se-ries, highlighting peculiar nature of M2M traffic. For a causalanalysis of the spikes in Fig. 3, we have manually analyzed thetraffic logs for potential patterns. Our analysis showed that all

spikes are caused by coordinated activities from thousands ofdevices belonging to the same device models, not by a smallnumber of “outliers.” For instance, spikes for the misc. cate-gory are caused by traffic belonging to thousands of devices ofa particular model exactly at hour marks.Time Series Clustering: Until now, we have only examined

the averaged time series for M2M device categories. To gainmore fine-grained insights, we construct more than 150 M2Mdevice model traffic time series from our trace, each repre-senting averaged time series of individual devices of respectivedevice models at 5-min time resolution. Likewise, we constructindividual device traffic time series at the same time resolution.However, the time series of individual devices at 5-min timeresolution over the duration of one week are less useful becausethey are highly sparse. To reduce their sparsity, we change thetime resolution to 1 h and also average them across all days.Therefore, the time series of individual devices each contain 24data points representing hourly time series averaged over alldays of the week.With these two sets of time series (device models and in-

dividual devices) at hand, we now aim to find some structureacross them by clustering together similar traffic time series.In this paper, we utilize discrete wavelet transform to analyzeand compute similarity score between time series at multipletimescales [7]. Wavelet transform is a generalized form ofFourier transform, which resolves it as a series of sines andcosines of different frequencies. Using discrete wavelet trans-form, a traffic time series is decomposed into multiple timeseries, each containing information at different scales that rangefrom coarse to fine. There are several well-known wavelet fam-ilies whose qualities vary according to several criteria. We needto select an appropriate wavelet type for our given problem.We explored a wide range of wavelet types. However, we focuson the results based on the well-known Daubechies-1 wavelettype, which is computationally and memory-wise efficient andis known to appropriately handle discontinuities [7]. Note thatthe traffic time series in our data, especially at finer time reso-lutions, often contain discontinuities. We rely on Daubechies-1to smooth out these discontinuities. The wavelet transformcan be applied for varying decomposition levels to capturevarying levels of detail (or scales). In this paper, we have usedCoifman and Wickerhauser’s well-known method to select theoptimal number of decomposition levels [8]. The basic ideaof this method is to select the decomposition level for whichthe joint information entropy of approximation and detailis minimized. We applied this method separately for devicemodel and subscriber traffic time series and then selected theoptimal decomposition level at the 95th percentile. Using theaforementioned criterion, we chose the optimal decompositionlevel to be 5 and 3 for device model and subscriber time series,respectively.Given the wavelet decompositions of device model and sub-

scriber time series, we aim to group time series into distinctclusters. Toward this end, we need to select appropriate simi-larity metric and clustering mechanism to group them. We firstnote that the length of all traffic time series is the same. There-fore, we can compute one-to-one difference between any twogiven time series and compute its norm to quantify their dis-similarity. This continuous definition of similarity between twotraffic time series allows us to apply hierarchical clustering. In


Fig. 5. Dendrograms for hierarchical clustering. (a) Device model. (b) Indi-vidual device.

this clustering method, we start by considering each traffic timeseries as a separate cluster and then recursively combine twoclusters that have the smallest distance between them. Here, weneed to define the distance between two clusters, each of whichmay contain more than one traffic time series. A well-knownmethod is called Ward’s method, which selects to merge twoclusters for whom the increase in the sum of squared distancesis minimum [13]. We use the Davies–Bouldin index to select theoptimal number of clusters from dendrogram, which is knownto result in compact and well-separated clusters [13]. Fig. 5(a)shows the dendrogram for hierarchical clustering of M2M de-vice model traffic volume time series. The -axis represents theindices of time series, and -axis represents the norm dis-tancemetric. In the dendrogram, we visually observe an obviousgrouping of device models into well-separated clusters. Usingthe Davies–Bouldin index, the optimal number of clusters is se-lected to be four for M2M device model dendrogram. Similarly,Fig. 5(b) shows the dendrogram for hierarchical clustering ofindividual device traffic volume time series. We observe a dif-ferent structure in this dendrogram as compared to the one inFig. 5(a). Here, we note that the bottom right of the tree con-tains several clusters, each containing one or a small numberof individual device time series. Intuitively, these small clusterspotentially represent outliers whose distance to other clusters isfairly large. We visually observe two clusters on the bottom leftof Fig. 5(b), each containing a major chunk of time series. Afterseparating out the sparse outlying clusters, these two clustersare selected as optimal by the Davies–Bouldin index. To furtherstudy the clusters identified using the above-mentioned method-ology, we plot their centroids with pointwise standard deviationsin Figs. 6 and 7. In these figures, the dark red lines representthe centroids, the blue lines represent pointwise standard devi-ations, and the light red lines in the background represent themember time series for each cluster.Fig. 6 shows device model clusters where we label the iden-

tified centroids based on two of their temporal characteristics:traffic volume and diurnal variations. We label a cluster centroidas high volume if its average normalized daily peak volumefor weekdays is more than . Otherwise, the cluster cen-troid is labeled as low volume. Similarly, we label the clustercentroids based on the diurnal variations in the following way.Let denote the diurnality coefficient, and , ,and denote themaximum,minimum, and average trafficvolumes, respectively, on day of a traffic time series spanning

days. The diurnality coefficient is quantified as

Fig. 6. Cluster centroids identified using device models traffic time series.(a) Low volume–low diurnality (LV-LD). (b) Low volume–high diurnality(LV-HD). (c) High volume–low diurnality (HV-LD). (d) High volume–highdiurnality (HV-HD).

If the diurnality coefficient of a cluster centroid is more than1.0, then it is labeled as high diurnality. Otherwise, it is labeledas low diurnality. Using this labeling methodology, we labelthe identified clusters as low volume–low diurnality (LV-LD),low volume–high diurnality (LV-HD), high volume–low diur-nality (HV-LD), and high volume–high diurnality (HV-HD).We now study the composition of these labeled clusters withrespect to the categories defined in Section II. Table I showsthe composition of the identified clusters across all categories,and the largest value in every row is marked as bold. We notethat asset tracking and fleet device models mostly belong tothe HV-HD cluster. Furthermore, we note that building secu-rity and telehealth device models mostly belong to the LV-HDcluster. These observations follow our intuition that the activityof these device models is tightly coupled with human activities.They also indicate that building security and telehealth devicemodels tend to generate low traffic volume. Similarly, we ob-serve that metering device models mostly belong to the LV-LDcluster. This observation follows our earlier finding from Fig. 4that metering devices tend to download or upload data after peri-odic time intervals throughout the day. Finally, we observe thatmisc. device models mostly belong to HV-LD clusters. Similar


Fig. 7. Cluster centroids identified using individual device traffic time series.(a) Diurnal. (b) Flat. (c) Outlier cluster.

TABLE ICOMPOSITION OF DEVICE MODEL CLUSTERS

to metering device models, misc. device models also tend togenerate traffic after periodic time intervals throughout the day,resulting in low diurnality.For individual device traffic volume time series clustering,

we identified a handful number of outlier clusters and two mainclusters containing a majority of devices. We plot the centroidsof two main clusters and one of the outlier clusters in Fig. 7. Thecluster centroid in Fig. 7(a) shows strong diurnal behavior withhigher traffic volume during daytime as compared to nighttime;therefore, we label this cluster as diurnal. On the other hand, thecluster centroid in Fig. 7(b) does not show any diurnal charac-teristics and is labeled as flat. We also show an outlier clusterin Fig. 7(c), which consists of devices generating traffic volumespikes at late night. To gain insights from the clustering resultsof individual device traffic volume time series, we study theircomposition across various M2M device categories. Table IIshows the cluster composition results with the largest value inevery row marked as bold. We have similar observations fordevice-level clustering as we previously had for device model

TABLE IICOMPOSITION OF INDIVIDUAL DEVICE TIME SERIES CLUSTERS

traffic volume time series clustering. For instance, asset trackingand fleet devices mostly belong to the diurnal cluster. Misc., me-tering, and telehealth devices, with spiky traffic volume time se-ries, mostly belong to the outlier cluster. Finally, building secu-rity devices mostly belong to the flat cluster. The individual de-vice-level clustering results further improve our understandingabout M2M traffic behavior.Summary: In this section, we have presented time series

analysis for M2M traffic volume. Just like that of smartphones,M2M traffic volume also exhibits strong daily diurnal pattern.However, M2M traffic volume peaks correspond to people’sworking hours, while smartphone traffic volume peaks cor-respond to waking hours, which indicates that a majority ofM2M devices are employed for business use. The overlapbetween M2M peaks and smartphone peaks suggests thatincentive-based leverage mechanism such as off-peak timepricing for encouraging better sharing of network capacitycan be beneficial. Toward this end, we presented a clusteringalgorithm that classifies M2M device models into four pri-mary cluster categories, which can serve as a guideline tonetwork operators in determining how to differentiate pricingfor different device models. Specifically, high volume and highdiurnality traffic results in higher peak load and wasted re-sources during nonpeak hours. Therefore, devices belonging tothe high volume and high diurnality cluster should be chargedrelatively more than those belonging to the low volume andlow diurnality cluster. We have also investigated fine-grainedfeatures in traffic volume time series for different categoriesand uncovered the differences in behaviors among differentM2M categories. For example, unlike other M2M categories,metering devices show only weak diurnal pattern, suggestingthat the traditional approach of scheduling service downtime inearly morning hours may not be the best for them. Finally, thesurprising discovery of synchronized communication amongM2M devices highlights the importance of developing and im-posing standard traffic protocols and randomization methods.Such synchronized communication can be discouraged byemploying 95th percentile pricing [9].

V. SESSION ANALYSIS

We now analyze and compare session-level traffic character-istics of M2M devices and smartphones. Understanding sessionduration and interarrival distribution is a time-honored traditionfor the telecommunication industry because they are importantinputs for network resource planning and management. Such in-formation is valuable for cellular network operators too becausedevice active time corresponds more closely to radio resourceusage than aggregate traffic volume [18]. Moreover, being able


to accurately estimate session timing parameters not only im-proves radio resource use efficiency for cellular operators; it alsohelps M2M service providers to better design their devices andprotocols for better battery management.Toward this end, we first formally define a session and then

study different metrics based on session-level information. Aflow consists of all packets in a given transport layer connec-tion, including TCP and UDP. To study characteristics of flowsat a given time resolution, we need to define equally spacedtime bins denoted by , where and denotesthe magnitude of time bin and is the index variable. Recallfrom Section II that the smallest available time resolution in ourtraffic trace is 5 min; therefore, we use min in thisanalysis. We look at flow arrivals in 5-min time bins as a binaryrandom process, which is denoted byand where 0 and 1 respectively denote absence or presence offlow arrival, respectively. We now define a session as a run offlow arrivals in consecutive time bins, where a flow spanningmultiple time bins is marked for all time bins during its span.A session is denoted by , where and arethe times corresponding to the first flow arrival and the last flowarrival of th session. In the following text, we separately inves-tigate several metrics that capture diverse characteristics of thesession arrival process.Active Time: The first metric that we study is device active

time, denoted by , which is the total amount of time in ourweek-long trace when a device is sending or receiving traffic. Inour study, it is calculated by multiplying number of unique timebins in which we have at least one flow arrival by the bin dura-tion. Using this metric, we are primarily interested in studyingthe impact of devices on the network in terms of radio channeloccupation. Note that a given time bin may have multiple flowarrivals, but they are all mapped to 1. Mathematically, activetime is defined as

In Fig. 8(a), we plot the CDFs of active time for smartphonesand all M2M categories defined in Section II. The -axis repre-sents active time, which ranges from aminimum of minto a maximum of one week (i.e., the duration of trace collec-tion). We first observe significant diversity in active time of de-vices of smartphone and all M2M categories. Our second ob-servation is that smartphones tend to have significantly moreactive time compared to all M2M device categories. The me-dian active time for smartphones is approximately 2 days, whichis approximately 30% of the total trace time duration. It is im-portant to note that active time cannot be accurately relatedto the interaction time of users with smartphones because ofthe following two reasons. First, users can interact with smart-phone without actually generating network traffic, e.g., playingoffline games. Second, some applications may generate back-ground traffic when the user may not be actually interacting withthe smartphone. We also observe diversity in the distributionsof active time across M2M device categories. Misc. and assettracking categories, with high aggregate traffic volume per de-vice, have the largest active time values among all categories.It is noteworthy that the fleet category, despite small aggregatetraffic volume per device, has above average active time values.This observation suggests that fleet devices tend to generate well

Fig. 8. CDFs of (a) active time, (b) average session length, (c) session interar-rival, and (d) memory.

spread-out traffic across different time bins. We have also ver-ified this conjecture from the data. Finally, telehealth and me-tering devices have the smallest active time among all M2Mdevice categories.Average Session Length: Another metric that we study is av-

erage session length , which is defined as the average countof consecutive time bins with flow arrivals. Mathematically, fora device with sessions, is defined as

Note that session lengths are potentially inflated becausesession timeouts may be missed due to the coarse measurementgranularity. Fig. 8(b) shows the CDFs of average sessionlength for M2M devices and smartphones. We note that asignificant chunk of devices for all categories have averagesession lengths smaller than or equal to 5 min (leftmost points).However, remaining devices do have average session lengths


Fig. 9. Gilbert–Elliot Markov chain to model burstiness of session arrivals.

significantly larger than the minimum value. For instance, 10%of devices of the misc. category have average session lengthslarger than 1 h, which reflects the way these devices operate.It is also interesting to note that smartphones typically havesignificantly smaller average session lengths compared to assettracking, fleet, and misc. categories. Among M2M categories,telehealth, metering, and building security have the smallestaverage session lengths.Average Session Interarrival:We also study the average ses-

sion interarrival metric, which is defined as the average of in-terarrival times between consecutive sessions. Using the earliernotion, we can mathematically define average session interar-rival as follows:

Fig. 8(c) shows the CDFs of average session interarrival timefor smartphone and M2M categories. We observe an approxi-mately opposite trend as compared to active time and averagesession length for M2M device categories. For instance, me-tering and telehealth categories, with relatively small activetime and average session lengths, have relatively large averagesession interarrival time with median values of approximately9 h. On the other hand, asset tracking and fleet categories haverelatively small average session interarrival time with medianvalues of less than 3 h. Smartphones tend to have even smalleraverage session interarrival time, where approximately 80% ofdevices have less than 1 hr average session interarrival time.Burstiness of Session Arrivals: Another useful metric for the

flow arrival process is burstiness. Burstiness jointly takes intoaccount the runs of zeros and ones in a binary random process.As mentioned earlier in this section, we have modeled the flowarrival process as a binary random process, where arrivals arenot independent. Given the assumption of conditional inde-pendence between consecutive flow arrivals, we can model theburstiness of the discrete flow arrival process using a first-orderand two-state discrete time Markov chain. This Markov chainis also known as the Gilbert–Elliot model and is shown inFig. 9. The two states of the Markov chain represent the arrivalor nonarrival of a session in a given time bin; for instance, state0 refers to nonarrival, and state 1 refers to arrival of a session.A suitable metric to model the burstiness of the Gilbert–Elliotmodel is its memory, which is denoted by and is defined as:

, where . Furthermore,corresponds to zero memory, corresponds to persis-tent memory, and corresponds to oscillatory memory.When , the probability of a session arrival at any timeinstance is independent of whether or not there was a sessionarrival in the previous time bin, i.e., the process is memoryless.Fig. 8(d) shows the CDFs of memory for smartphone and M2Mcategories. We again observe significant differences across

smartphones and M2M devices. Specifically, we note that morethan 50% of smartphones have oscillatory memory, whereasmore than 80% of M2M devices have persistent memory. Thisindicates that most M2M devices, on average, tend to show per-sistence in network activity, i.e., a time bin with no flow arrivalis likely to be followed by another without flow arrival, and atime bin with flow arrival is likely to be followed by anotherwith flow arrival. Among M2M device categories, buildingsecurity category has the largest percentage of subscribers withnegative memory values, indicating the presence of oscillatorymemory. These subscribers are more likely to follow an activetime bin with an inactive time bin and an inactive time bin withan active time bin. The rest of the M2M device categories onlyhave a small fraction of subscribers with negative memoryvalues.Summary: Once again, M2M traffic sessions exhibit rather

different characteristics from smartphone traffic sessions.Overall, M2M devices are active for traffic for much lesstime than smartphones. M2M traffic sessions occur much lessfrequently. However, M2M traffic sessions are more bursty.Consequently, the values of Radio Resource Control (RRC)timeouts of M2M devices can be decreased to avoid excessiveradio channel occupation. Likewise, the values of RRC timersof smartphones can be increased to avoid excessive statetransitions that result in degraded network performance [18].It is also worth noting that three out of six M2M categorieshave about 80% of the devices with average session timelasting less than 5 min. This indicates that byte volume ofdata traffic for these devices is likely not an accurate reflectionof their network resource use due to disproportional amountof control plane overhead for establishing and tearing downshort sessions. The large differences between different M2Mcategories also advocate for differentiated RRC configurationsfor different categories.

VI. MOBILITY

In this section, we study and compare the mobility char-acteristics and geographical distribution of M2M devicesand smartphones. Mobility patterns for different devices,constructed from our nationwide trace, help establish an un-derstanding for how much they move. Understanding mobilitypatterns for different devices has a direct impact on networkresource planning. More importantly, we are interested ininvestigating how the locations of M2M device populationare distributed relative to those of smartphones. Previously inSection IV, we have discovered that M2M traffic volume peaksoverlap with those of smartphones in time. Here, we investigatewhether they also overlap in space.It is important to note that cell identifiers derived from in-

formation collected within the core network are not consideredan accurate approximation for device location. This is becausemany low-level radio access network operations such as hand-offs of mobile devices between cells are not exposed to the corenetwork. However, we consider such inaccuracy acceptable forthree reasons. First, Xu et al. reported that although cell-sectorinformation collected from the core network is not exact for thepurpose of being used as device location, the median error is

km [26]. Second, we do not use the locations of the celltower to proximate user device locations. We simply count thenumber of unique cells with which a device is involved. Finally,


Fig. 10. CDFs of unique cells for Smartphone and M2M categories.

the scope of our study covers the whole US, compared to whichcell-level errors at kilometer scale are rather minor.Device Mobility: We quantify mobility in terms of the

number of unique cells to which a device connects. It isnoteworthy that a device can be stationary and still connectto multiple cells at different time instances when it is in thecoverage area of multiple cell sectors simultaneously. Fig. 10shows the CDFs of unique cells for different M2M devicecategories and smartphones. We observe that devices of M2Mcategories appear across less unique cells compared to smart-phone devices, with the exception of asset tracking category.This is expected because asset tracking devices are typicallyconnected to automotive vehicles for transportation of goodsand tend to transmit more frequent updates, e.g., temperatureand check-in information. Interestingly, fleet devices are lessmobile than asset tracking devices and even smartphones. Thisis probably because fleet devices in our trace are mostly usedby car rental companies and tend to transmit less frequentupdates, e.g., milage and accidents. Overall, while we mightintuitively believe that asset tracking and fleet devices are moremobile than the average smartphone, our results show that thedifference is rather insubstantial. Furthermore, as expected,we observe that building security and metering devices appearacross the least number of cells.Geographical Distribution: We now investigate the geo-

graphical distribution of M2M traffic. Toward this end, we firstplot the Voronoi diagrams for traffic volume of cell-level aggre-gated M2M and smartphone traffic in Fig. 11. The geographicalregion shown in this figure covers more than 1 million squarekilometers, spanning multiple states in the US (about 1/9 of itstotal area). The Voronoi diagrams are generated by partitioningthe 2-D space, containing points representing base stationlocations, into polygons such that each polygon contains onebase station and every point in a given polygon is closer to itsbase station than others. Note that the polygons in the Voronoidiagrams represent cells covering varying geographical areas.The clusters of cells covering small geographical areas appeararound major population centers. The colors of polygons repre-senting the traffic volume show that cells typically carry moresmartphone traffic than M2M traffic. We plot the distributionsof cell-level aggregated traffic volume for smartphones andM2M devices in Fig. 12, which verify our earlier observation.From the perspective of network operators, we are interestedin identifying locations with highest traffic volume for smart-phones and M2M devices. Toward this end, in the rest ofthis section, we focus on the top 10% cells in terms of trafficvolume for smartphones and M2M devices. These correspondto the right-hand side tails of the distributions plotted in Fig. 12.Furthermore, we want to identify geographical dependencies

Fig. 11. Geographical distribution of (a) aggregate M2M and (b) smartphonetraffic volume.

Fig. 12. PDFs of cell-level traffic volume for M2M and smartphone devices.

among their locations for the top 10% cells for smartphones andM2M devices. The three possible types of geographical depen-dencies between two sets of locations are: attraction, repulsion,and independence. Attraction or repulsion between two setsof location respectively indicate correlation or anticorrelation,whereas independence indicates no correlation at all.A well-known method to characterize geographical de-

pendency between two sets of points is based on the nearestneighbor statistics [5]. Specifically, for two sets of points and, we can define as the probability that the distance froma randomly selected point to the nearest event is less thenor equal to . Likewise, we can define as the probabilitythat the nearest point to a random point is less then or equalto . If the two sets of points are geographically independent,then . Given and respectively point to thetop 10% locations for M2M and smartphone traffic in terms oftraffic volume, Fig. 13(a) plots (Smartphone-M2M) and(Point-M2M) for varying values of . A theoretical Poisson

line is also plotted for reference, which indicates the expectedpattern if both sets of points are independently distributed ashomogeneous Poisson processes. We observe that both andsignificantly depart from the theoretical Poisson line, and

they are also not close to each other. This observation indicatesthat the point sets and do not follow homogeneous Poissondistribution and are also not independently distributed of eachother. The question remains if the point sets show attraction


Fig. 13. Point pattern interaction analysis for high volume M2M and smart-phone cell locations. (a) Nearest neighbor. (b) Cross-L.

or repulsion to each other. This question is also addressed bythe relative positioning of and lines, where the linerises above . This pattern shows that we have more thanexpected high-volume M2M locations nearest to high-volumesmartphone locations. This indicates that these point sets areattracted to each other.Another well-known method to study the geographical de-

pendency of two point sets and , called cross- , is based onRipley’s cross- function [5]. It is denoted by andis defined as

where is the empirical Ripley’s cross- function anddenotes the distance. The empirical Ripley’s cross- functionis defined as

Here, is the average intensity of point set , and is theexpectation operator. Positive and negative values ofrespectively indicate attraction and repulsion between two pointsets. The co-independence is indicated if the remainsbetween the estimated confidence envelope lines for co-inde-pendent homogeneous Poisson processes. This method over-comes one limitation of the nearest neighbor analysis that it isnot restricted to only considering the closest points. However,it is also limited because it gives us the average impression ofall points in the data set and may overlook small-scale local de-pendencies. Fig. 13(b) shows the plot of for varyingvalues of . We again observe a significant attraction patternbetween high-volume M2M and smartphone traffic locations.These two sets of experiments jointly provide a strong evidencethat high-volume M2M and smartphone traffic locations are at-tracted to each other.Summary:Most M2M devices, except asset tracking devices,

are more likely to remain within a smaller geographical areacompared to smartphones. On the other hand, the geographicaldistribution of M2M device population, especially those withhigh traffic volume, exhibits “attraction” to high-volume smart-phone devices. In other words, the information provided by theanalysis of mobility characteristics ofM2M devices is mixed fornetwork operators. While M2M devices are less mobile, whichsuggests that service optimization is easier to conduct becauseit only involves a small area, the co-location of high volumeM2M devices with smartphone devices brings more chance forcongestion in such areas.

Fig. 14. Traffic application distributions of M2M device categories andsmartphone. The application indices along -axis are: 1) ;2) ; 3) ; 4) ; 5) ; 6) ; 7) ; 8) ;9) ; 10) ; 11) ; 12) ; 13) ;14) ; 15) ; 16) ; and 17) . (a) Downlink M2M. (b) UplinkM2M. (c) Smartphone.

VII. APPLICATION USAGE

So far in this study, we have treated all data bits equally,simply as “traffic volume.” However, the truth is that not all bitsare equal. For example, a bit that is part of an 8-bit encoding ofa temperature reading obviously has higher information densitythan a bit in an image of a thermometer that displays the temper-ature. In this section, we attempt to understand how M2M de-vices use data traffic by exploring the application-mix of M2Mdata traffic.Recall from Section II that traffic records in our data set

are tagged with application identifiers. These identifiers covertraffic of 17 different application realms, including HTTP,e-mail (POP, IMAP, etc.), and all common video streamingprotocols (HTTP streaming, flash, etc.), all of which makeup the vast majority of smartphone traffic volume. Using thisapplication classification, we can compute application distri-bution of traffic volume for all M2M device categories. Weobserve that 95% of all flows in our trace belong to TCP. Thisobservation is in accordance with the findings reported in priorliterature [12], [17], [19]. We provide the averaged uplink anddownlink application distribution of traffic volume for all M2Mdevice categories in Fig. 14. To first average a device category,we take the ratio of the sum of traffic volume of all devices andthe total number of devices. We then normalize the averagedtraffic application volumes by their maximum value. We notefrom Fig. 14(a) and (b) that the traffic of all device categoriesmostly belongs to unknown or miscellaneous realms. Thisindicates that M2M devices typically use custom protocolsthat are either not identified by our application classification


Fig. 15. CDFs of (a) round-trip time and (b) packet loss ratio.

methodology, mentioned in Section II, or they use atypicalprotocols.It is interesting to compare application distribution of M2M

traffic with that of smartphone traffic shown in Fig. 14(c). Asexpected, smartphone traffic mostly belongs to Web browsing,audio and video streaming, and e-mail applications. This is insharp contrast to what we have observed for M2M traffic.Summary:M2M devices mostly use custom application pro-

tocols. This makes it more difficult for network operators tounderstand and mitigate adverse effects from these protocolscompared to the standard ones such as HTTP. Toward this end,better standardization of M2M protocols would certainly be amutually beneficial solution for both M2M application serviceproviders and cellular network operators.

VIII. NETWORK PERFORMANCE

We now characterize the network performance of M2Mtraffic. We examine network performance in terms of round-triptime (RTT) and packet loss ratio, both of which provide usunique perspectives of network performance.Round-Trip Time: RTT is an important metric for network

performance evaluation and is a key performance indicator thatquantifies delay in cellular networks. The RTT metric is espe-cially important for M2M applications that are real-time crit-ical. It is important to note that RTT measurements can be po-tentially biased by differences in the paths between differentcellular devices and the external servers with which they com-municate. For this study, we only have RTT measurements forTCP flows, which are estimated by the time duration betweenthe trace collecting apparatus seeing a SYN packet and its corre-sponding ACK packet in the TCP handshake. Fig. 15(a) showsthe CDFs of the median RTTs experienced by each device forsmartphones and all M2M device categories. We observe thatall M2M device categories experience larger RTT compared tosmartphones. Furthermore, withinM2M device categories, tele-health devices have smaller RTT than all other categories. Ourmanual investigation of hardware specifications showed thatsmartphones and telehealth devices are mostly equipped with3Gmodems, in contrast to other categories that typically rely on2G modems. 2G RTTs are larger due to longer delays on the air

interface, which explains these observations. In addition, smart-phones are generally equipped with more powerful processorsthan M2M devices. Therefore, faster TCP/IP stack implemen-tations on smartphone processors can also impact RTT.Packet Loss Ratio: Packet loss ratio is a key performance

indicator metric that quantifies reliability in cellular networks.We estimate the packet loss ratio from the fraction of the ob-served TCP sequence number range to the observed TCP pay-load bytes, summed over all TCP flows. This ratio is subtractedfrom 1 to obtain the packet loss ratio. Since most packet loss oc-curs in the radio access network (RAN) and our measurementpoint is in between the RAN and the Internet, this metric effec-tively estimates the downlink packet loss ratio. Fig. 15(a) showsthe CDFs of packet loss ratio for smartphones and all M2M de-vice categories. Similar to the CDFs of RTT shown in Fig. 15,we observe differences for packet loss ratio distribution in termsof third and fourth quartile values, where smartphones and tele-health devices experience at least an order of magnitude lowerloss ratios than other M2M device categories due to a largerratio of 3G to 2G modems. We also observe that building se-curity devices have much higher third and fourth quartile lossratios than other M2M devices, despite using similar technolo-gies. This may be due to the placement of these devices indoors,where the signal quality is poorer.Summary: M2M traffic’s network performance also differs

from that of smartphones. The RTT of M2M traffic is signifi-cantly larger than smartphone traffic. Careful inspection of thehardware specifications of M2M devices reveals that M2M de-vices generally fall behind smartphones in choice of cellulartechnology. A majority of M2M devices still use 2G technolo-gies such as GPRS and EDGE. Although 2G technologies areoften adequate for M2M communication in terms of data rates,such lagging does present a challenge for cellular operators be-cause they would need to maintain older-generation services,instead of repurposing 2G spectrum for newer technologies ofhigher spectral efficiency.M2M traffic also generally has higherpacket loss ratios. This is probably because some M2M devicesare placed in locations with poor signal reception. It shows theneed for M2M devices to have screens displaying cellular signalstrength like cell phones.

IX. CONCLUSION AND FUTURE DIRECTIONS

This paper presents the first attempt to characterize M2Mtraffic in cellular data networks. Our study was based on aweek-long traffic trace collected from a major cellular serviceprovider’s core network in the US. In our analysis, we com-pared M2M and smartphone traffic in several aspects includingtemporal traffic patterns, device mobility, application usage,and network performance. We found that although M2M de-vices have different traffic patterns from smartphones, theyare generally competing with smartphones for shared networkresources.Our findings presented in this paper have important implica-

tions on cellular network design, management, and optimiza-tion. Through better understanding of M2M traffic, cellular ser-vice providers can improve resource allocation mechanisms anddevelop better billing strategies for different categories of M2Mdevices. Toward this end, software defined networking (SDN)can be used for device- or subscriber-aware dynamic and flex-ible resource allocation and management [15]. SDN can also


help to isolate or slice cellular network resources via virtualiza-tion to avoid contention between smartphone and M2M traffic.Note that this isolation or slicing can be fine-grained for dif-ferent M2M device categories, or even different M2M applica-tions. Moreover, delay-tolerant and non-mission-critical M2Mtraffic can be relayed over white spaces. The aforementionednetwork design and management techniques can impact the dy-namics of M2M traffic and in turn may require introduction ofnovel pricing models by network operators.

REFERENCES[1] AT&T, Florham Park, NJ, USA, “AT&T specialty vertical

devices,” [Online]. Available: http://www.rfwel.com/support/hw-support/ATT_SpecialtyVerticalDevices.pdf

[2] ABI Research, Oyster Bay, NY, USA, “3G machine-to-machine(M2M) communications: Cellular 3G, WiMAX, and municipal Wi-Fifor M2M applications,” Tech. Rep., 2007.

[3] Berg Insight, Gothenburg, Sweden, “The global wireless M2Mmarket,” Tech. rep., 2010.

[4] Cisco, San Jose, CA, USA, “Cisco visual networking index: Globalmobile data traffic forecast update,”White Paper, 2012, pp. 2011–2016.

[5] R. S. Bivand, E. J. Pebesma, and V. Gomez-Rubio, Applied SpatialData Analysis With R. New York, NY, USA: Springer, 2008.

[6] “LMU-2600 GPRS fleet tracking unit,” 2012 [Online]. Available:http://www.calamp.com/pdf/LMU-2600.pdf

[7] P. Chaovalit, A. Gangopadhyay, G. Karabatis, and Z. Chen, “Discretewavelet transform-based time series analysis and mining,” Comput.Surveys, vol. 43, no. 2, p. 6, 2011.

[8] R. Coifman and M. Wickerhauser, “Entropy-based algorithms for bestbasis selection,” IEEE Trans. Inf. Theory, vol. 38, no. 2, pp. 713–718,Mar. 1992.

[9] X. Dimitropoulos, P. Hurley, A. Kind, and M. P. Stoecklin, “On the95-percentile billing method,” in Proc. PAM, 2009, pp. 207–216.

[10] J. Erman, A. Gerber, M. T. Hajiaghayi, D. Pei, and O. Spatscheck,“Network-aware forward caching,” in Proc. WWW, 2009, pp. 291–300.

[11] Z. M. Fadlullah, M. M. Fouda, N. K. A. Takeuchi, N. Iwasaki, andY. Nozaki, “Toward intelligent machine-to-machine communicationsin smart grid,” IEEE Commun. Mag., vol. 49, no. 4, pp. 60–65, Apr.2011.

[12] A. Gerber, J. Pang, O. Spatscheck, and S. Venkataraman, “Speedtesting without speed tests: Estimating achievable download speedfrom passive measurements,” in Proc. ACM IMC, 2010, pp. 424–430.

[13] N. Grira, M. Crucianu, and N. Boujemaa, “Unsupervised and semi-su-pervised clustering: A brief survey,” MUSCLE Eur. Network of Excel-lence (FP6), 2004.

[14] L. K. Law, S. V. Krishnamurthy, andM. Faloutsos, “Capacity of hybridcellular-ad hoc data networks,” in Proc. IEEE INFOCOM, 2008, pp.1606–1614.

[15] L. E. Li, Z. M. Mao, and J. Rexford, “CellSDN: Software-defined cel-lular networks,” Computer Science, Princeton University , Princeton,NJ, USA, Tech. rep., 2012.

[16] Z. Moczar and S. Molnar, “Comparative traffic analysis study of pop-ular applications,” in Proc. Int. Conf. Energy-Aware Commun., 2011,pp. 124–133.

[17] U. Paul, A. P. Subramanian, M. M. Buddhikot, and S. R. Das, “Un-derstanding traffic dynamics in cellular data networks,” in Proc. IEEEINFOCOM, 2011, pp. 882–890.

[18] F. Qian, Z. Wang, A. Gerber, Z. M. Mao, S. Sen, and O. Spatscheck,“Characterizing radio resource allocation for 3G networks,” in Proc.ACM IMC, 2010, pp. 137–150.

[19] M. Z. Shafiq, L. Ji, A. X. Liu, J. Pang, and J. Wang, “Characterizinggeospatial dynamics of application usage in a 3G cellular data net-work,” in Proc. IEEE INFOCOM, 2012, pp. 1341–1349.

[20] M. Z. Shafiq, L. Ji, A. X. Liu, and J. Wang, “Characterizing and mod-eling Internet traffic dynamics of cellular devices,” in Proc. ACM SIG-METRICS, 2011, pp. 305–316.

[21] Evolved Cellular Network Planning and Optimization for UMTS andLTE, L. Song and J. Shen, Eds. Boca Raton, FL, USA: CRC, 2010.

[22] P. Stoica and R. L. Moses, Introduction to Spectral Analysis. UpperSaddle River, NJ, USA: Prentice-Hall, 1997.

[23] P. Traynor, M. Lin, M. Ongtang, V. Rao, T. Jaeger, P. McDaniel, andT. L. Porta, “On cellular botnets: Measuring the impact of maliciousdevices on a cellular network core,” in Proc. ACM CCS, 2009, pp.223–234.

[24] Trilliant, Redwood City, CA, USA, “CellReader digital cel-lular meters,” [Online]. Available: http://www.trilliantinc.com/products/cellreader/

[25] International Telecommunication Union, Geneva, Switzerland, “Worldtelecommunication/ICT indicators database 2011,” 2011 [Online].Available: http://www.itu.int/ITU-D/ict/publications/world/world.html

[26] Q. Xu, A. Gerber, Z. M. Mao, and J. Pang, “AccuLoc: Practical local-ization of performance measurement in 3G networks,” in Proc. ACMMobiSys, 2011, pp. 183–196.

M. Zubair Shafiq received the B.E. degree inelectrical engineering from the National Universityof Sciences and Technology, Islamabad, Pakistan, in2008, and is currently pursuing the Ph.D. degree incomputer science and engineering at Michigan StateUniversity, East Lansing, MI, USA.His research interests are in big data analytics and

performance modeling.Mr. Shafiq was a co-recipient of the IEEE ICNP

2012 Best Paper Award. He also received the 2012Fitch-Beach Outstanding Graduate Research Award

from the College of Engineering, Michigan State University.

Lusheng Ji (SM’06) received the Ph.D. degree incomputer science from the University of Maryland,College Park, MD, USA, in 2001.He is a Principal Member of Technical Staff—Re-

search with the AT&T Shannon Laboratory, FlorhamPark, NJ, USA. His research interests include wire-less networking, mobile computing, wireless sensornetworks, and networking security.

Alex X. Liu received the Ph.D. degree in computerscience from the University of Texas at Austin,Austin, TX, USA, in 2006.His research interests focus on networking and

security.Dr. Liu is an Associate Editor of the IEEE/ACM

TRANSACTIONS ON NETWORKING. He received theIEEE & IFIP William C. Carter Award in 2004 andan NSF CAREER Award in 2009. He received theWithrow Distinguished Scholar Award in 2011 atMichigan State University, East Lansing, MI, USA.

He received Best Paper awards from ICNP 2012, SRDS 2012, and LISA 2010.

Jeffrey Pang received the Ph.D. degree in computerscience fromCarnegieMellonUniversity, Pittsburgh,PA, USA, in 2009.He is a Researcher with AT&T Labs—Research,

Florham Park, NJ, USA. He currently builds systemsto measure and optimize cellular networks. His re-search interests include networking, mobile systems,distributed systems, and privacy.

JiaWang received the Ph.D. degree in computer sci-ence from Cornell University, Ithaca, NY, USA, in2001.She joined AT&T Labs—Research, Florham Park,

NJ, USA, since then and is now a Principal Tech-nical Staff Member with the Network Measurementand Engineering Research Department. Her researchinterests focus on network measurement and man-agement, network security, performance analysis andtroubleshooting, IPTV, social networks, and cellularnetworks.

1960 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL ...alexliu/publications/M2M/M2M_ton_NJU.pdfdevices...

Documents

Transcript of 1960 IEEE/ACM TRANSACTIONS ON NETWORKING, VOL ...alexliu/publications/M2M/M2M_ton_NJU.pdfdevices...