Factor analysis of Internet traffic destinations from similar source networks

Abstract

Purpose -This study aims to assess whether similar user populations in the Internet produce similar geographical traffic destination patterns on a per-country basis.Design/methodology/approach -We have collected a country-wide NetFlow trace, which encompasses the whole Spanish academic network, which comprises more than 350 institutions and one million users, during four months. Such trace comprises several similar campus networks in terms of population size and structure. To compare their behaviors, we propose a mixture model, which is primarily based on the Zipf-Mandelbrot power law to capture the heavy-tailed nature of the per-country traffic distribution. Then, factor analysis is performed to understand the relation between the response variable, number of bytes or packets per day, with dependent variables such as the source IP network, traffic direction, and country.Findings -Surprisingly, the results show that the geographical distribution is strongly dependent on the source IP network. Furthermore, even though there are thousands of users in a typical campus network, it turns out that the aggregation level which is required to observe a stable geographical pattern is even larger. Consequently, our results show a slow convergence rate to the domain of attraction of the model, specifically, we have found that at least 35 days worth of data are necessary to reach stability of the model's estimated parameters.Practical implications -Based on these findings, conclusions drawn for one network cannot be directly extrapolated to different ones. Therefore, ISPs' traffic measurement campaigns should include an extensive set of networks to cope with the space diversity, and also encompass a significant period of time due to the large transient time.Originality/value -Current state of the art includes some analysis of geographical patterns, but not comparisons between networks with similar populations. Such comparison can be useful for the design of Content Distribution Networks and the cost-optimization of peering agreements.

On the real impact of Path Inflation in networks under production

“…Based on the results from [6], at least 35 days of traffic measurements from a subnetwork should be aggregated to make stable the traffic distribution of the geographic destinations. Consequently, we have gathered 35 days of flow measurements from the Point of Presence in Madrid, which allow us to calculate the number of bytes that are destined to each foreign country, and the IP addresses that are requested.…”

“…2 in logarithmic scale. A logarithmic scaling is necessary in order to enhance visibility provided the power-law shape of the traffic distribution [6]. To draw the maps, we used Google's Visualization API 2 that can be used directly as a gadget from Google docs.…”

“…These papers show that about 20% of Internet paths are inflated by more than 50% in terms of number of hops from the source to the destination with regards to the optimal route path. However, the authors point out that they are assuming that all the routes between each pair of studied hosts are equally likely, and this is not true [6].…”

“…This limitation directly applies to the representativeness of the results they provide, given that it is assumed that each analyzed connection pairs are equally likely. Previous work [6] shows that this is far to be the case, essentially it is pointed out that there is a small set of destinations with large popularity, and a large set of destinations which is barely accessed. So why ISPs should pay attention to the inflation of such unpopular routes?…”

“…The measurement of PI entails the identification of the intermediate nodes in a network path and the geographical mapping of IP addresses to measure PI in terms of distance. The selection of representative nodes is based on a trace analysis, which should be at least 35 days long in order to obtain stable destination patterns according to the results in [6]. Our findings after applying the proposed metric show that the most critical regions to pay attention to are the closest After reviewing the related work in Section II, the rest of the paper is organized as follows.…”