Multiscale Analysis and Data Networks

Abstract

The empirical finding of self-similarity in data network traffic over many time scales motivates the need for analysis tools that are particularly well adapted for identifying structures in network traffic. These structures span a range of time scales or are scale-dependent. Wavelet-based scaling analysis methods are especially successful, both collecting summary statistics from scale to scale and probing the local structure of packet traces. They include both spectral density estimation to identify large time-scale features and multifractal estimation for small time-scale bursts. While these methods are primarily statistical in nature, we may also adapt them to visualize the "burstiness" or the instantaneous scaling features of network traffic. This expository paper discusses the theoretical and implementation issues of wavelet-based scaling analysis for network traffic. Because data network traffic research does not consist solely of analysis, we show how these wavelet-based methods may be used to monitor and infer network properties (in conjunction with on-line algorithms and careful network experimentation). More importantly, we address what types of networking questions we can and cannot investigate with such tools. 

Multiscale nature of network traffic

“…Note that h s ( ) may very well be larger than one, as is the case with all cascades. A simple argument yields [31] the more useful dual statement: if the largest h satisfying (10) is noninteger, then the local polynomial P s is necessarily constant and h s ( ) can be computed using (12). Fig.…”

Network traffic analysis using singular value decomposition and multiscale transforms

“…In the following, using the properties of wavelets and self-similar function, we present the methodology described in [1,7,8] for the detection of anomaly in data. The coefficients in the wavelet representation of a self-similar function satisfy the following simple relation: for any integers j, m, n, k such that j = m + n, we have…”

“…In traffic modeling, however, the term 'self-similar' is usually used to refer to the asymptotically second order self-similar LRD process [23]. Therefore, in the study of anomaly of traffic data, any deviation of H from 0.5 to 1 range signifies the presence of anomaly in data [1,7]. In this paper, we use this observation for the detection of anomaly present in data.…”

“…Therefore, the data set that is a time series of packet count (i.e. number of packets per unit time) made at regular time intervals consists of sudden To say that a time series or a process or a measure displays scaling property means many different things depending on the context and the definition of scaling property [7]. Underlying all such definitions is the intuitive notion that the process considered has no inherent characteristic scale, i.e., it possesses scale invariance.…”

“…It is commonly accepted [7,23] that, by definition, the LRD property means that the auto-correlation function r(k) of a wide-sense-stationary process X n slowly decreases according to a power law such as r(k) $ c r k À(2À2H) as k ! 1, where c r > 0 and H 2 (0.5, 1).…”