Structural analysis of network traffic flows
- 1 June 2004
- conference paper
- conference paper
- Published by Association for Computing Machinery (ACM)
- Vol. 32 (1), 61-72
- https://doi.org/10.1145/1005686.1005697
Abstract
Network traffic arises from the superposition of Origin-Destination (OD) flows. Hence, a thorough understanding of OD flows is essential for modeling network traffic, and for addressing a wide variety of problems including traffic engineering, traffic matrix estimation, capacity planning, forecasting and anomaly detection. However, to date, OD flows have not been closely studied, and there is very little known about their properties.We present the first analysis of complete sets of OD flow time-series, taken from two different backbone networks (Abilene and Sprint-Europe). Using Principal Component Analysis (PCA), we find that the set of OD flows has small intrinsic dimension. In fact, even in a network with over a hundred OD flows, these flows can be accurately modeled in time using a small number (10 or less) of independent components or dimensions.We also show how to use PCA to systematically decompose the structure of OD flow timeseries into three main constituents: common periodic trends, short-lived bursts, and noise. We provide insight into how the various constitutents contribute to the overall structure of OD flows and explore the extent to which this decomposition varies over time.Keywords
This publication has 19 references indexed in Scilit:
- An information-theoretic approach to traffic matrix estimationPublished by Association for Computing Machinery (ACM) ,2003
- Fast accurate computation of large-scale IP traffic matrices from link loadsACM SIGMETRICS Performance Evaluation Review, 2003
- Internet intrusionsACM SIGMETRICS Performance Evaluation Review, 2003
- Sketch-based change detectionPublished by Association for Computing Machinery (ACM) ,2003
- Experience in measuring internet backbone traffic variability: Models metrics, measurements and meaningTeletraffic Science and Engineering, 2003
- A signal analysis of network traffic anomaliesPublished by Association for Computing Machinery (ACM) ,2002
- Deriving traffic demands for operational IP networks: methodology and experienceIEEE/ACM Transactions on Networking, 2001
- Wide area traffic: the failure of Poisson modelingIEEE/ACM Transactions on Networking, 1995
- On the self-similar nature of Ethernet traffic (extended version)IEEE/ACM Transactions on Networking, 1994
- Application of the Karhunen-Loeve procedure for the characterization of human facesIeee Transactions On Pattern Analysis and Machine Intelligence, 1990