- This paper proposes a method of mixed traffic model formation, which allows to create statistical models of mixed traffic for each network element as well as to have sustainable statistical data characterizing mixed traffic on each network element. It also shows diversity of network traffic by its basic characteristics. Limitations of applicability of existing models and methods complex for mixed network traffic specification are discussed herein. We offer a variant of mixed stream decomposition to uniform streams using the Theory of Pattern Recognition methods. We offer a variant of uniform stream representation as random numerical sequences relevant to packets arrival time. There is grounding for selection of rules for checking of accordance between experimental and theoretical distribution in respect to uniform streams of network traffic typical for existing and perspective information telecommunication systems.
The rationale for developing of method of mixed traffic model formation is predetermined by significant number of actual circumstances and importance of date characterizing traffic for practice.
These data are necessary for solving important practical
tasks on calculation of probabilistic time-response
characteristics of specified subnetwork elements, required
performance determination – , at specified traffic intensity –
and at assigned service procedure by switching nodes, and
finding facts and reasons for traffic parameters abnormal
alteration [
Relating to the statistical and uniform traffic, we developed
a complex of models and methods [
However, the current multiservice communication systems are characterized by a number of distinguishing features which do not admit of traditional methodological approach.
Clear representation about the scope of information
processed by switching nodes in current information
telecommunication systems can be obtained examining statistic
of overall traffic transferred through Internet Exchange Points.
The overall traffic transferred through node MSK-IX1 is shown
on Figure 1 [
II. METHOD OF MIXED TRAFFIC MODEL FORMATION Significant traffic volumes allow to have a huge sampling that is substantially different from the situation where the number of experiments is relatively small.
The method of mixed traffic model formation is expected to be realized in relatively stand-alone five phases. Graphical view of model formation process is shown on Figure 2.
Mixed traffic Mixed traffic fixation
Algorithm for recognition of mixed
traffic Database of streams reference description
Mixed traffic decomposition to uniform streams
Unit for the 1-st stream ID creating Unit for the i-th stream ID creating Unit for the k-th stream ID creating Timer t0 to Δt Measurement and creating of input data (ID) for subsequent statistical processing
Sequential hypothesis
testing Sequential hypothesis
testing Sequential hypothesis
testing Database of random values distribution
functions Statistical processing
Random values distribution law Random values distribution law Random values distribution law Model collection for subnetwork element of communication network
The first phase involves elements fixation for traffic processed by –th element of selected communication subnetwork.
There are dedicated means — network protocol analyzers which are used for mixed traffic fixation and resulted IP packets header values determination. The typical functions of network protocol analyzer are packets capturing, decryption, packet analysis and displaying. As an example the most common network protocol analyzers could be considered: Wireshark, York, SoftPerfect Network Protocol Analyzer, Accurate Network Monitor and etc. All of them allow to have information concerning date and time of packet capturing, source and destination IP address, protocol type (network, transport or application layer) and other information about captured data.
During the second phase, based on the set of specified characteristics a mixed traffic stream is decomposed to uniform ones. The model is suitable for various network protocols traffic processing, at the same time packet header formats may differ by structure. The header formats have considerable number of fields which can take on considerable but limited number of values. Decomposition based on packet classification condition with exactly identical values in all fields will lead to unnecessarily increasing of uniform stream number that make more difficult to realize proposed model.
Based on existing tasks it is acceptable to ignore some of fields values. From the other hand it is possible to perform packets classification conditions according to all header fields values. Moreover we can use specific traffic analyzers to make classification according to packet body content. It confirms the model flexibility.
We present the mixed traffic stream in a form of some data aggregate. In the proposed model decomposition is based only on header characteristics, characteristics of payload transferred in packet when assigning stream to certain class will be ignored.
The recognition performs two basic operations. At first, it is calculation of realization similarity factor with all references. Second operation is assigning of realization to reference with highest similarity. The recognition as decomposition of some set to certain number of non-empty disjoint subsets using selected criteria.
The primary criterion is the assignment of mixed traffic stream to one of existing network protocol (IP, X.25, etc.), at a later stage classification is performed based on criteria arising from differences of packet header fields values. Network packet structure and fill range of permissible fields values are always known and finite which is necessary condition for combining of various networks to single one. Up to date described in RFC 791 specification IPv4 protocol and its sequel, IPv6, are basic network protocols. This protocol is used as an example for further description but the developed method allows to work with any primary date.
IP packet header size may vary from 20 bytes to 60 bytes and contain as minimum 12 fields (Version, IHL, Type of Service, Total Length, Identification, Flags, Fragment Offset, Time to Live, Protocol, Header Checksum, Source Address, Destination Address), therefore, assignment of packets with identical headers to separate class would create its huge number.
Format of IP packet header is shown on Figure 3.
IHL: 4 bits. Internet Header Length is the length of the internet header in 32 bit words, and thus points to the beginning of the data.
Type of Service: 8 bits. The Type of Service provides an indication of the abstract parameters of the quality of service desired.
Total Length: 16 bits. Total Length is the length of the datagram, measured in octets, including internet header and data. This field allows the length of a datagram to be up to 65,535 octets.
Identification: 16 bits. An identifying value assigned by the sender to aid in assembling the fragments of a datagram.
Time to Live: 8 bits. This field indicates the maximum time the datagram is allowed to remain in the internet system. If this field contains the value zero, then the datagram must be destroyed. This field is modified in internet header processing.
Protocol: 8 bits. This field indicates the next level protocol used in the data portion of the internet datagram. Options: variable. The options may appear or not in datagrams.
Full description of IP packet header fields you can find at RFC 7912.
In the context of the current task the subject of interest is only uniform streams with a large share in overall stream. It is reasonable to group all relatively uncommon streams into separate class.
Packet reference description database may be presented in logic table format. Let’s define by a set containing selected classes of homogeneous in the sense of equality of header selected fields values or disjoint values ranges, and by a set of all possible header fields values or disjoint values ranges. In this case if j-th header field value corresponds to -th class of packets then table element ( , ) = 1, otherwise ( , ) = 0.
A table such as the one described above but containing all possible variants of values would have dramatic dimension that is not necessary because in practice only packet classes containing certain values in header are interesting.
To assign any mixed traffic packet to closest uniform class we will use the Theory of Pattern Recognition methods. The Theory of Pattern Recognition method based on pair-wise 2 https://tools.ietf.org/html/rfc791 3 www.ibm.com/support/knowledgecenter/ru/SSLVMB_24.0.0/ spss/base/cmd_proximities_sim_measure_binary.html comparison of object to be recognized with reference set. The following similarity measures are available for binary data3:
Russell-Rao. This is a binary version of the inner (dot) product. Equal weight is given to matches and nonmatches. This is the default for binary similarity data.
Simple matching. This is the ratio of matches to the total number of values. Equal weight is given to matches and nonmatches.
Jaccard. This is an index in which joint absences are excluded from consideration. Equal weight is given to matches and nonmatches. Also known as the similarity ratio.
Dice. This is an index in which joint absences are excluded from consideration, and matches are weighted double. Also known as the Czekanowski or Sorensen measure.
Rogers and Tanimoto. This is an index in which double weight is given to nonmatches and others.
The indices listed above can be used as a function ( 1, 2, … , ), which determines the "distance" between classes in the attribute space with the coordinates 1, 2, … , .
The task of pattern recognition using the methods of statistical recognition theory is realized in two stages. The stage of learning and constructing the standard descriptions of classes and the stage of recognition.
The source of information about recognizable images is the set of results of independent observations (sampling values) that make up the learning (learning) ( )1 = ( 1, 2, … , ) and the control (exam) ( )1 = ( 1, 2, … , ) samples, and depending on the nature of the recognition problem (onedimensional or multidimensional) can be either a onedimensional or a - dimensional random variable.
Training is aimed at the formation of standard class descriptions. The decisive rule based on the formation of the likelihood ratio and its comparison with a certain threshold , the value of which is determined by the selected quality criterion: ̂ = ̂ ( 1, 2,…, | 2) ≥ ̂ ( 1, 2,…, | 1) (1) where ̂ ( 1, 2, … , | ) is the he estimate of the conditional joint -dimensional probability density 1, 2, … , provided they belong to the class .
At the stage of training and the construction of reference class descriptions, the following actions are performed: 1) Form a set of characteristics from the number of available to measure the characteristics of the object 1, 2, … , .
2) Specify the function ( 1, 2, … , ) that defines the "distance" between classes in the characteristic space with the coordinates 1, 2, … , .
Define the probability distribution of probability characteristics for classes. sum = 2 | = ∑ =1 ,).
4) Calculate and select new characteristics 1, 2, … , , < , which correspond to the minimal eigenvalues in the
The above sequence of actions will reduce the number of features that will reduce the cost of performing measurements and calculations.
The recognition problem can be reduced to the problem of recognition of multidimensional normal populations.
Approaches to the solution of this problem are clearly set forth
in [
At the stage of measuring and creating of primary data for further statistical processing the random numerical sequences relevant to arrival time of packets belonging to uniform stream will be received in a form of sequences of arrival times of packets belonging to uniform streams: ( ; + ) = { 1 , … , l , … , },, where - numerical sequence of arrival times of packets belonging to uniform stream; ; + current time range; 1 - arrival time of -th packet, -th stream.
The selection of set of distribution functions was conducted on the basis of physical meaning of random value specifying time intervals between uniform traffic packets arrivals. Random values will be located only on positive semiaxis and uniform by nature traffic for which IP-header fields values are equal may be overall traffic of large number of users or applications used one type communication service.
Database of distribution functions may be created from following distribution laws: gamma distribution,
distribution, Rayleigh distribution, Pareto distribution and others which are not contrary to physical meaning of random value specifying time intervals between uniform traffic packets arrivals.
Mentioned above distribution laws are presented in Table 1.
During fourth stage statistical processing of uniform network
traffic streams performs to establish continuous distribution law
which most highly specifies random value sample of which was
obtained
during
experimental observations, a
hypothesize
concerning accordance between experimental and theoretical
distribution put forward which may be checked applying various
accordance criteria [
The most frequently applicable in practice criteria are: 1)
of 2 type; 2)
criteria:
Kolmogorov criterion, Smirnov criterion, Mises criterion. They
differed in the conditions of applicability when testing the
accordance hypothesize for various distribution laws (see GOST
0: ( ) = ( , 0), where ( ) - density function; 0 - known
scalar or vector parameter of theoretical distribution which used
during accordance testing. The complex hypothesize has a form
0: ( ) ∈ { ( , ), ∈ }, where Θ – space of parameters and
scalar or vector parameter estimator ̂ is calculated using the
same sampling as for accordance hypothesize testing [
From the proposed in the method sequence of events taking into account characteristics of obtained uniform traffic streams and applicability of various accordance criteria we offer use hypothesize testing criterion of 2 type for testing accordance between experimental and theoretical distribution. Application of 2 type criteria is described in GOST R 50.1.
When testing simple hypothesize concerning accordance between experimental and theoretical distribution of random value , the following sequence of actions is implemented: a) Form a tested hypothesize by choosing a theoretical distribution of random value ( , ) accordance of which is worth checking.
b) Make random sampling of volume from aggregation. c) According to sampling volume select interval number . values ( ).
d) Select edge points of group interval. In doing so the sampling
may be stratified into intervals of equal length, intervals of equal probability or according to asymptotically optimum grouping for selected distribution law, but because distribution laws for various ∆ may be different, we suggest to use the stratifying into intervals of equal length. In this case it is necessary to calculate number and determine probability e) After calculations and ( ) according to selected testing criterion it is necessary to calculate test statistics value ∗ according to the formula (2) or (3):
2 = ∑ =1
( ) ( ⁄ − ( ))2, (2) оп = −2 ln = −2 ∑ =1 ln ( ( ) ).
(3) ⁄ f) According to 2−1 - distribution in accordance with the formula (4) calculate value { > ∗}. If { > ∗} > , where is specified significance level, then there is no reason for rejecting of tested hypothesize. Otherwise, tested hypothesize is rejected.
1 ∫∞ ⁄21 − ⁄2 { 2 > ∗2} = 2 ⁄2Γ( ⁄2) 2 > (4).
Calculated test statistics value ∗ is compared with critical value , , where = − 1 is the number of degrees of freedom defined by the equation: 1
Values , are given in the various handbooks. Accordance hypothesize is rejected if test statistics value is in critical range, i.e. at ∗ > , .
During complex hypothesize testing and parameter estimators calculation on grouped date, as a result of minimization of statistics predetermined by formulas (2) and (3) a checking sequence is similar to case of simple hypothesize with setting the number of degrees of freedom = − 1, where is number of parameters estimated according to this sampling. Herewith, recommendations regarding grouping method remain valid.
At the firth stage reasonable set of distribution functions is received, each function specify particular network traffic packet stream as well as their aggregate traffic source.
Create statistical models of mixed traffic for each network element.
Obtain statistical models of mixed traffic which can be used for analysis of real communication networks and design of perspective communication networks.
Provide its updating when implementing perspective protocols.
With additional development of methods of model intercomparison for various network elements obtained using proposed method fix the fact of abnormal traffic change and identify its reasons.