Time-Series Models for Internet Data Traffic. Chun You and Kavitha Chandra

Transcription

1 1 Time-Series Models for Internet Data Traffic Chun You and Kavitha Chandra Center for Advanced Computation and Telecommunications Department of Electrical and Computer Engineering University of Massachusetts Lowell Lowell, MA ABSTRACT A statistical analysis of Internet traffic measurements from a campus site is carried out to examine the influence of the constituent protocols and applications on packet delay and loss performance. While TCP remains the dominant protocol in the traffic through all hours of the day, a mixture of both well-known (http, ftp, nntp and smtp) and less known applications (???) contribute significant portions to the TCP traffic mix. Statistical tests show that the aggregate TCP packet arrival process exhibits both non-stationary and non-linear features. Filtering a subset of the applications from the aggregate process based on their individual index of stationarity magnitudes a stationary traffic stream is derived. The filtered traffic process is modeled using nonlinear threshhold autoregressive processes. This model is shown to provide good agreement with the packet loss and delay statistics of the measurement trace and provides a simple and accurate approach for simulating Internet data traffic patterns. 1.0 Introduction Traffic measurement studies have amply demonstrated the complexity inherent in data traffic patterns [xxx]. Data packet arrivals are found to be correlated over both short and long-time scales. These features generally result from the arrival of bursts of packets of comparable size, often leading to high instantaneous arrival rates. Short time correlation features model the traffic dynamics within a burst time-scale, whereas the long range correlation measures the structural similarity across successive packet bursts. Traffic modeling studies have attempted to capture these short and long-range features through self-similar fractal and multifractal processes [xx]. However both of these models require that the underlying process exhibit reasonable timestationarity in its arrival rates. We show in this paper that applications such as FTP induce significant non-stationarity in the aggregate arrival process and produce correlation functions that decay very slowly in time. Since these applications are typically subdominant in their bit rate contribution, it is proposed that the filtering out of such applications from the aggregate traffic stream will allow us to build more reliable models for traffic prediction and forecasting. To establish a differential services framework it will be necessary to determine the level of aggregation at the edge of the network and a set of traffic parameters that can adequately describe such an aggregated stream. In this work, an aggregation scheme based on application level identifiers is proposed and a parametric time-series model proposed for the aggregated traffic. In Section 2.0, we present relevant statistical features of the Internet traffic measurements used in this work. In Section 3.0, a stationarity test is used to identify applications that need to be

2 2 filtered from the aggregate traffic stream. Section 4.0 describes the fitting of a nonlinear timeseries model to the filtered traffic process. Section 4.1 compares the queueing performance of the simulated traffic with measurements. Section 5.0 concludes the paper. 2.0 Statistical Features of Internet Traffic The traffic measurements analyzed in this work are obtained from the Ohio State University (OSU) connection to the vbns (very high-performance Backbone Network Services). The vbns consists of an OC12 backbone and interconnects NSF-supported supercomputer centers, research and educational institutions and government sponsored networks. The measurements are collected using the OC3MON utility [1]. OC3MON is a programmable data collection and analysis tool developed by MCI and the National Laboratory for Networking Research (NLANR??). The OC3MON platform consists of an IBM PC with two ATM interface cards that are attached to an OC3 optical fiber pair carrying IP-over-ATM traffic and terminated on a switching device. The receive port of each ATM card is connected to the monitor port of an optical splitter. The two interface cards independently capture the traffic received and transmitted by the switch. The OC3MON software extracts headers from packet traces and applies timestamps. The trace files are made available to the public at the archive These trace files are typically two minute duration samples obtained approximately every three hours. For this analysis were also able to obtain from NLANR a two hour trace for the OSU site. 2.1 Weekly, Daily and Hourly Traffic Trends We consider the analysis of traffic that flows in the direction from the OSU campus to the Internet. First the long-term statistics involving daily and weekly patterns are examined. Two consecutive weeks of OSU measurements from March 1, 1999 to Mar. 14, 1999 are considered for this analysis. The daily traffic pattern is represented by eight samples obtained at approximately three hour intervals. The total traffic volume generated in each measurement set was determined to examine for the presence of hourly, daily or weekly trends.fig. 1(a-b) depict the volume of traffic bytes uploaded to the backbone network from the OSU site. The horizontal axis represents the day of the week and the hour at which the measurement was started. Each bar represents the aggregate traffic within a two minute time sample. It can be seen that the traffic volume approaches a minimum during the early morning hour of 4am and 7am, and starts to increase from 7am onwards. The peak traffic volume typically occurs around 4 pm. This pattern is consistent across the two weeks of data. The traffic volume during the peak hours is also found to decrease on the weekends. Next we consider one day of data and examine the distribution of traffic bytes across the various Internet protocols. In characterizing this feature, we consider the distribution across the well-known protocols Transport Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), Internet Group Management Protocol (IGMP). The remaining set of protocols are simply denoted as Other. The percentage of traffic distribution across these protocols as a function of time of day (3/1/99) is shown in Fig. 2. We can observe from Fig.2 that: (a) over 95% of the traffic volume arises from the TCP protocol and this feature is found to be invariant across the entire day; (b) UDP represents the next highest contributor to traffic volume, typically in the 2 5% range, and decreasing significantly during the off-peak hours.

3 3 The dominant TCP traffic is analyzed further based on the source port indices attributed to each packet. These port numbers provide information on the applications that are carried by the TCP protocol. The dominant applications in these data files are Hypertext Transport Protocol (HTTP, port 80), File Transfer Protocol (FTP, port 20), Network News Transfer Protocol (NNTP, port 119) and Simple Mail Transfer Protocol (SMTP, port 25). Fig. 3 displays the percentage of traffic volume in bytes that is generated by each of these protocols around the 4 pm peak hour in each day. The horizontal axis represents the date. The well-known protocols are typically dominant, contributing 60-80% of the total traffic volume. Although the less well-known Other applicationsare seen to have a non-neglible influence in byte count to the aggregate traffic. To further characterize this traffic mix, we examine next the traffic statistics on a finer time scale by considering a continuous trace of two hour duration. 2.2 Statistics of Packet Arrival Process The traffic measurements obtained from OC3MON provide the time stamp, packet size, protocol type, source, destination port numbers and source and destination addresses for every Internet packet that traverses the monitored link. The two hour packet trace was mapped to a time series by aggregating the packet arrivals over successive non-overlapping time periods of duration 0. 1 second. Prior to the hypothesis of a stochastic model for these measurements, the basic characteristics of stationarity and linearity of the time-series will be examined. Stationary Test: The test for stationarity will be based on calculating and examining the trend in the arrival rates over successive non-overlapping and fixed duration time windows. For a fixed window size τ s the set of mean arrival rates {a i, i = 1, 2,... N} were determined, where N represents the number of window segments that result from the time-series. The sequence of a i for the aggregate time series may be examined visually for underlying trends and tested quantitatively under the hypothesis that each a i is an independent sample value of a random variable. Under this hypothesis the variations in the sample values a i will be random and exhibit no trends. Then the number of runs in the sequence relative to, say the median value will be as expected for a sequence of independent random observations of the random variable [2]. If the probability of remaining below or above the median value remain unchanged from one a i to the next, then the sampling distribution of the number of runs in the sequence of a i may be determined and tabulated for various confidence intervals. This is referred to as the run-test. In applying this test to the traffic data, the temporal correlation of the time-series must be taken into consideration and the selection of the time window τ s should be governed by the maximum correlation time-scale we wish to accomodate in our traffic model. The value of τ s is selected in the range of seconds, yielding 200 and 100 values of a i respectively. For each τ s, the number of runs of a i relative to the median were determined and evaluated against the expected number for a 95% confidence interval. The results for N = 100 is shown in Fig. 4. The two solid lines depict the range from [xx - xx] for which the stationarity hypothesis would be accepted. The results of the run test are plotted for the aggregate time-series, denoted AGG and for the individual time-series representing the dominant application ports. The application ports highlighted in the figure are selected to be the top ten applications that contribute to over 85% of the TCP traffic process. It can be observed that while the aggregate TCP process exhibits significant deviation from stationarity, the applications corresponding to http (80), nntp (119), xx, xx approach the boundaries of being accepted as sta-

4 4 tionary processes. On the other hand, applications such as ftp (20) exhibit highly nonstationary behavior. The breakup in traffic percentage of each application is tabulated in Table I. Protocol Traffic Fraction (%) Linearity Test We consider the TCP traffic arrival process obtained by filtering out application processes identified to exhibit nonstationary features. The normalized autocorrelation function (acf) of this filtered process may be compared to that of the aggregate TCP stream in Fig. 5. The removal of nonstationary components leads to a significant reduction in the temporal correlation of the arrival process???. The acf is a measure of linear dependence between the random variates of the time series and can suggest a choice of linear autoregressive and/or moving average (ARMA) models that can capture the observed correlation function. However tests of linearity and normality of the data will have to be confirmed before such models are hypothesized. To examine nonlinear dependence, conditional statistics as given by sample regression functions [3] are obtained. The lag j regression function of a time-series X n is defined as r j = E[X n X n j = x]. The estimates of r j for j = 1, 2, 3, 4 are depicted in Fig. 5. The horizontal axis represents a partition of the amplitude range of the time series into a finite set of disjoint sets. The vertical axis represents the function r j determined by calculating an average of all samples that satisfy the regression constraint. For Gaussian distributed linear processes the regression functions exhibit a linear trend. The regression functions depicted in Fig. 5 show a deviation from linear structure. We have found that the best linear ARMA models that can fit the measurements fail to capture the variability and the index of dispersion of the arrival process and significantly underestimate the bit loss statistics in a queue. In the next section, we propose a non-linear time-series model that comprises of a set of linear ARMA processes and a conditional switching rule in time. 3.0 Threshold Autoregressive (TAR) Models The TAR model is a nonlinear model comprised of a set of linear AR models which are valid in disjoint subregions of the time-series amplitude. At a given time the subregion selected will depend on the amplitudes observed over lagged time values. The TAR model and its variants have been successfully applied for modeling time-series data exhibiting cyclical properties and long-range dependence [4]. The model considered here will incorporate two amplitude ranges denoted as low (L) and

5 5 high (H) amplitude states. In the low-state the times-series takes on values L: (0, ˆr], where ˆr is a threshold value. The high state accommodates amplitudes H:[ˆr, ). This is done to capture the observed excursions about the amplitude ˆr. In addition a delay value d will be used to determine the state of the process. The combination of two amplitude regimes and a lag value result in two sub-regions that describe the time-series. These sub-regions are denoted as R j j = 1, 2. The governing AR process x(n) at time n is selected based on the amplitude of the time series at the lagged amplitude x(n d). For each of the R j the process evolves as a stable AR process, governed by the correlations within that region. The current value of the byte-rate at time n will be governed by an autoregressive process of order k j. x(n) = a ( j) 0 + k j Σ a ( j) i x(n i) + e j (n) (1) i=1 when x(n d) R j. Here the term e j (n) represents samples derived from an independent identically distributed random process having zero mean and finite variance. When sub-region constraints are violated, the process is switched to the sub-region model that obeys the proper amplitude and delay constraints. The delay parameter affords the flexibility of capturing persistence phenomenon at the required amplitudes. Extended sojourn in the high byte-rate state is an important feature in delay management, whereas dwell-time in the low byte-rate state has impact on multiplexing efficiency. Therefore the thresholds R j and delay parameters should be carefully chosen to capture these critical elements in the traffic variation.

6 6 3.1 TAR Model Parameter Selection To construct the model, the optimal values of ˆr, and the delay d must be selected along with the coefficients of the local AR processes for each subregion. For a given delay and threshold value the local AR coefficients a j, and the variance of the residual σ 2 j are determined using least-squares estimators. The process of TAR parameter estimation is that outlined in Tong [10]. To estimate the local AR parameters, the data is searched for all samples x(n) that satisfy the given amplitude and delay constraints R j. For each R j, the vector x j = (x j i 1,...,x j i n j ) T contains the n j time-series samples that satisfy constraint R j. For this data, the k th j order linear model coefficients are evaluated. x j = A j a j + e j (2) where a j :(a j 0, a j 1...,a j k j ) T and A j is a n j xn j matrix with each row comprised of the k j values that lag the elements of x j and e j = (e j i 1,...,e j j n j ) T is the residual error vector. Since n j >> k j, the solution of the system of equations in Eq. (2) is the least-squares estimate of a j, denoted as â j. The error variance σ 2 j = ê j 2 /n j is determined as the approximate Maximum Likelihood Estimate of the noise variance. For the fixed delay d, the threshold amplitude ˆr is sampled uniformly in the range??? and??? in?? byte intervals. The maximum model order of the AR model was set equal to 30. For each subregion R j the least-squares estimates of the local AR coefficient was determined using Eq. (2). The optimum order k j for the j th sub-model corresponds to the value k that yields the minimum value for the Akaike Information Criteria (AIC) statistic AIC(k j ) [5]. This process is repeated for all sub-regions, for each value of ˆr and d. The total AIC as a function of the threshold and delay parameters is computed as AIC total (d, ˆr) = Σ 2 AIC(k j ). The optimal threshold parameter ˆr, delay d and AR parameters are those that yield the minimum AIC total (d, ˆr). j=1 To simulate the TAR process, only the initial conditions were determined from the measurements. Subsequent values were generated using the TAR parameter estimates and additive noise variables for each sub-region. The noise process was derived from the empirical distributions of the error residuals obtained during the fitting of the measurements to the model. In the simulation, any neg ative values that resulted were set to be equal to zero???. Results from the TAR model simulation are presented next. 3.2 Model Evaluation Several statistical features were derived from the simulated data and measurements to evaluate the performance of the traffic model. The QQ (quantile-quantile) plots of marginal distributions of the byte-amplitudes and autocorrelation functions are shown in Figs. (x) and (x). The visual assessment of the QQ plots indicate a good agreement in the marginal distributions, even in the tail regions. The acf plots show that the TAR model captures the trend in the data up to about 60 lags. The TAR model was also found to perform well in capturing the first two moments and the trend in the index of dispersion of the arrival counts up to time-scales of 5 seconds.

7 7 To determine if an adequate number of time-scales were represented in the model, the performance of the model was evaluated in a finite buffer queue, serviced at a constant rate. The results of the bit-loss-ratio (BLR) as a function of a normalized service rate are plotted in Fig. (?). The service rate is varied from the source average to the peak rate. The buffer size is expressed in units of seconds. These results are compared to the losses experienced by driving the queue with the measurements. The BLRs are depicted for buffer sizes of and 0. 1 seconds. 4.0 Conclusions Acknowledgements The authors would like to thank Hans Werner-Braun and the NlANR for providing access to the OC3mon measurements. This research was supported by the National Science Foundation CAREER grant NCR

8 8 REFERENCES 1. J. Apisdorf, K. Claffy, K.Thompson and R. Wilder,"OC3MON: Flexible, Affordable, High Performance Statistics Collection," Proc. of INET 97, Kuala Lumpur??, Malaysia, June J.S. Bendat and A.G. Piersol, Random Data: Analysis and Measurement Procedures, Chapt. 7, Wiley- Interscience, H. Tong, Threshold Models in Non-linear Time Series Analysis, Lecture Notes in Statistics, vol. 21, Springer-Verlag, P.A.W. Lewis and B.K. Ray, "Modeling Long-Range Dependence, Nonlinearity and Periodic Phenomenon in Sea Surface Temperatures using TSMARS," J. American Statistical Association, 92 (439), pp , September S.M. Kay, Modern Spectral Estimation, Chap. 7, Prentice Hall, Englewood Cliffs, NJ, 1988