Honeypots to detect malware and mitigate network traffic ...
Connection-level Analysis and Modeling of Network Traffic understanding the cause of bursts control...
10
Connection-level Analysis and Modeling of Network Traffic understanding the cause of bursts control and improve performance detect changes of network state
-
Upload
anna-knight -
Category
Documents
-
view
215 -
download
2
Transcript of Connection-level Analysis and Modeling of Network Traffic understanding the cause of bursts control...
Connection-level Analysis and Modeling of Network Traffic
understanding the cause of burstscontrol and improve performancedetect changes of network state
R. Riedi Spin.rice.edu
Explain bursts
Large scale: Origins of LRD understood through ON/OFF model Small scale: Origins of bursts poorly understood, i.e.,ON/OFF model with equal sources fails to explain bursts
Load (in bytes): non-Gaussian, bursty
Number of active connections: Gaussian
R. Riedi Spin.rice.edu
Non-Gaussianity and Dominance
Connection level separation:– remove packets of the ONE strongest connection– Leaves “Gaussian” residual traffic
Traffic components:– Alpha connections: high rate (> ½ bandwidth)– Beta connections: all the rest
Overall traffic Residual traffic1 Strongest connection
= +Mean
99%
R. Riedi Spin.rice.edu
CWND or RTT?
Correlation coefficient=0.68
Short RTT correlates with high rate
103
104
105
106
10-1
100
101
102
peak-rate (Bps)
1/R
TT
(1/
s)
Correlation coefficient=0.01
103
104
105
106
102
103
104
105
peak-rate (Bps)cw
nd (
B)
Colorado State University trace, 300,000 packets
cwnd 1/RTTrate
cwnd 1/RTTrate
Beta Alpha Beta Alpha
Challenge: estimation of RTT and CWND/ratefrom trace / at router
R. Riedi Spin.rice.edu
Impact: Performance• Beta Traffic rules the small Queues• Alpha Traffic causes the large Queue-sizes
(despite small Window Size)
Alpha connections
Queue-size overlapped with Alpha PeaksTotal
traffic
R. Riedi Spin.rice.edu
Two models for alpha traffic
Impact of alpha burst in two scenarios:• Flow control at end hosts
– TCP advertised window
• Congestion control at router– TCP congestion window
Modeling Alpha Traffic• ON/OFF model revisited:
High variability in connection rates (RTTs)
Low rate = beta High rate = alpha
fractional Gaussian noise stable Levy noise
+
=
+
+
=
Self-similar Burst Model• Alpha component = self-similar stable
– (limit of a few ON-OFF sources in the limit of fast time)
• This models heavy-tailed bursts – (heavy tailed files)
• TCP control: alpha CWND arbitrarily large – (short RTT, future TCP mutants)
• Analysis via De-Multiplexing:– Optimal setup of two individual Queues to come closest to
aggregate Queue
De-Multiplexing:Equal critical time-scales
Q-tail ParetoDue to Levy noise
Beta (top) + Alpha
R. Riedi Spin.rice.edu
ON-OFF Burst Model• Alpha traffic = High rate ON-OFF source (truncated)• This models bi-modal bandwidth distribution• TCP: bottleneck is at the receiver (flow control
through advertised window)• Current state of measured traffic• Analysis: de-multiplexing and variable rate queue
Beta (top) + Alpha Variable Service Rate Queue-tail Weibull (unaffected) unless
• rate of alpha traffic larger than capacity – average beta arrival • and duration of alpha ON period heavy tailed
R. Riedi Spin.rice.edu
Conclusions
• Network modeling and simulation need to include– Connection level detail– Heterogeneity of topology
• Physically motivated models at large• Challenges of inference
– From traces– At the router
• Need for adapted Queuing theory
