Cluster processes: a natural language for network traffic

Abstract

We introduce a new approach to the modeling of network traffic, consisting of a semi-experimental methodology combining models with data and a class of point processes (cluster models) to represent the process of packet arrivals in a physically meaningful way. Wavelets are used to examine second-order statistics, and particular attention is paid to the modeling of long-range dependence and to the question of scale invariance at small scales. We analyze in depth the properties of several large traces of packet data and determine unambiguously the influence of network variables such as the arrival patterns, durations, and volumes of transport control protocol (TCP) flows and internal flow structure. We show that session-level modeling is not relevant at the packet level. Our findings naturally suggest the use of cluster models. We define a class where TCP flows are directly modeled, and each model parameter has a direct meaning in network terms, allowing the model to be used to predict traffic properties as networks and traffic evolve. The class has the key advantage of being mathematically tractable, in particular, its spectrum is known and can be readily calculated, its wavelet spectrum deduced, interarrival distributions can be obtained, and it can be simulated in a straightforward way. The model reproduces the main second-order features, and results are compared against a simple black box point process alternative. Discrepancies with the model are discussed and explained, and enhancements are outlined. The elephant and mice view of traffic flows is revisited in the light of our findings.

Scaling Limits for Cumulative Input Processes

“…BecauseS n , and hence the limiting process, have stationary increments, the covariance structure of the limiting process and hence its finite-dimensional distributions, are completely determined by its one-dimensional marginal distributions. We obtain, thus, convergence of the finite-dimensional distributions in (19).…”

“…If the process N c is a randomly stopped renewal process, we obtain a model that we will here call a renewal Poisson cluster process. This model was studied in Faÿ et al [11], see also Hohn and Veitch [18] and Hohn et al [19] for some empirical studies. It can be explicitly constructed as follows.…”

“…Moreover, if (18) holds for some < min 2 , then (19) can be extended to convergence in 0 . (ii) Suppose that < −1 or = −1 and 0 g x dx < .…”

Modeling teletraffic arrivals by a Poisson cluster process

“…Most of the results are obtained in the Gaussian case, see Bardet et al [3]. An empirical wavelet based application to the cluster Poisson model can be found in Hohn et al [19]. Using the above properties of the wavelet coefficients, in particular (6.48), an alternative estimation procedure was suggested by Moulines et al [26]; see also Wornell and Oppenheim [35].…”

“…Lewis used this model for analyzing computer failure patterns and Bartlett applied it to bunching in motor traffic. Hohn et al [19] applied the Poisson cluster process for modeling computer traffic. In particular, they model flows arriving at the points of a Poisson process.…”