Spectral Analysis of Bottleneck Traffic

Xinming He, Christos Papadopoulos, John Heidemann, Urbashi Mitra, Usman Riaz, and Alefiya Hussain
USC/Information Sciences Institute

Abstract

Internet traffic contains a rich set of periodic patterns imposed by various processes. Examples include back-to-back packet transmissions on bottleneck links, periodic routing information exchange, transport layer effects such as TCP windowing behavior, and application layer effects such as misconfigured DNS clients. Analyzing such periodic patterns has wide applications, including a better understanding of network traffic dynamics, diagnosis of network anomalies, and detection of DDos attacks. However, current understanding of periodic behavior in aggregate traffic is quite limited. Many previous approaches often analyze traffic on a per-flow basis, and do not scale well to analyze high speed network traffic. This paper explores the application of spectral techniques to analyze network traffic. We propose an experimental methodol- ogy to guide the application, and as a case study, we use this methodology to analyze the spectral characteristics imposed by bottleneck links on aggregate traffic. In our approach, we passively gather packet traces from the network and then apply spectral techniques to extract periodic patterns embedded in the trace, particularly the regularities imposed by various bottleneck links. Unlike techniques utilizing packet inter-arrival time, our approach does not require flow separation or grouping. The only information required is the packet arrival time. Our experiments show that bottleneck links impose distinct signatures on the underlying traffic, and these signatures can be detected by a downstream monitoring point. We introduce four non-parametric algorithms based on the Bayes Maximum-likelihood Classifier to detect bottleneck flows inside the aggregate, and evaluate their performance using real Internet traffic. As our future work, we plan to design parametric detection algorithms for better performance, and apply the methodology to study other periodic network phenomena.

Availability

This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below.

Reference

He05a

Xinming He, Christos Papadopoulos, John Heidemann, Urbashi Mitra, Usman Riaz, and Alefiya Hussain. Spectral Analysis of Bottleneck Traffic. Technical Report USC-CSD-TR-05-854, University of Southern California Computer Science Department, May, 2005. <http://www.isi.edu/~johnh/PAPERS/He05a.html>.

@techreport{He05a,
	title = "Spectral Analysis of Bottleneck Traffic",
	author = "Xinming He and Christos Papadopoulos and John Heidemann and Urbashi Mitra and Usman Riaz and Alefiya Hussain",
	institution = "University of Southern California Computer Science Department",
	year = "2005",
	number = "USC-CSD-TR-05-854",
	month = "May",
	keywords = "spectral analysis, quals proposal",
	url = "http://www.isi.edu/~johnh/PAPERS/He05a.html",
	pdfurl = "http://www.isi.edu/~johnh/PAPERS/He05a.pdf",
	otherurl = "http://www.cs.usc.edu/Research/TechReports/xxx04-827.zip",
	myorganization = "USC/Information Sciences Institute",
}

Copyright

This paper is copyright © 2005 by its authors. Permission to make digital or hard copies of part or all of this work for personal use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Abstracting with credit is permitted.

To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission of the authors.