APPLICATION OF CHAOS THEORY TO ANALYSIS OF COMPUTER NETWORK TRAFFIC Liudvikas Kaklauskas, Leonidas Sakalauskas

Transcription

1 The XIII Inernaonal Conference Appled Sochasc Models and Daa Analyss (ASMDA-2009) June 30-July Vlnus LITHUANIA ISBN L. Sakalauskas C. Skadas and E. K. Zavadskas (Eds.): ASMDA-2009 Seleced papers. Vlnus 2009 pp Insue of Mahemacs and Informacs 2009 Vlnus Gedmnas Techncal Unversy 2009 APPLICATION OF CHAOS THEORY TO ANALYSIS OF COMPUTER NETWORK TRAFFIC Ludvkas Kaklauskas Leondas Sakalauskas Insue of Mahemacs and Informacs Akademjos 4 LT Vlnus Lhuana Absrac. The arcle deals wh sascal unversy nework raffc by applyng he mehods of selfsmlary and chaos analyss. The objec of measuremen s Šaula Unversy LNe nework node mananng nsuons of educaon of he norhern Lhuana regon. Tme seres of nework raffc characerscs are formed by regserng amoun of nformaon packes n a node a dfferen regmes of nework raffc and dfferen values of dscreon of regsered nformaon are presen. Measuremen resuls are processed by calculang he correlaon measure of he seres analysng aracors esmang he fracal measure calculang Hurs nde and esmang relably of analyss resuls by applyng he sascal mehod. Invesgaon of he nework raffc allowed us drawng conclusons ha me seres bear feaures of self-smlary when aggregaed me seres bear feaures of slowly decreasng dependence and me seres aracors depend on he group of srange aracors. Keywords: correlaon Hurs coeffcen fracaly fracal measure cluser analyss sandard devaon perssen process chaos.. Inroducon Self-smlary of nework raffc as an ndependen scenfc drecon was formed very recenly. Emprcal research n hs feld was made by J. Beran [2] K. Park [3] W. Wllnger [ 3] M. S. Taqqu [] W. E. Leland [] G. Samorodnsky [7] and many oher researchers. Self-smlary of nework raffc make possble o adequaely prognoscae he change of raffc and o apply he prognoss resuls n ncrease of nework hroughpu and mprovemen of s qualy of servce whle regulang packe laency flucuaon resrcon and packe loss ransporaon on daa and physcal OSI layers [8]. In conemporary unversy sudes compuer neworks are wdely appled; hey ofen undergo nonprognoscaed overload. For effecve nework conrol s necessary o perform monorng of nework nodes n order o prognoscae nework node load and overload. Mehods of non-lnear (chaos) heory are appled for modellng and descrpon of nework processes whle esmang he heavy-als whch characerse large bursness of nework raffcs [8]. The am of hs research s o analyse measuremen resuls of Šaula Unversy LNe nework node raffc and o esmae s self-smlary. ulogd sofware for Lnu operaonal sysem dsrbued under GPL lcence was used for measuremen of nework raffc [6]. Daa was regsered whle applyng dfferen levels of me dscresaon a dfferen levels of nework load presen whle formng aggregaed me seres. 2. Measuremen of nework raffc For measuremen of nework raffcs Šaula Unversy LNe nework node wh he hghes nensy of raffc load was chosen. In hs node receved ner-cy channel raffc of Gbps s dsrbued o he unversy and educaonal nsuons of Šaula regon. Only daa packes arrvng a he node whle dsregardng sen packes were analysed. Inal measuremen was carred ou wh eacness of one mcrosecond. Daa-based record was formed rgh afer recevng TCP or oher proocol s daa frame. ulogd s a userspace loggng daemon for nefler / pables relaed loggng. Every pre-roued packe s regsered by ulogd daemon n PosgreeSQL daabase. Daa from January :30:35 o Aprl :00:00 was chosen for analyss. Whn hs perod more han hree bllon records were accumulaed n he daa base; hey corresponded o seconds or 03 days 0 hours 29 mnues and 25 seconds. Analyss of nensy of daa raffc suggess ha he hghes daa raffc n he node s observed on week days he leas on Sundays and Saurday occupes he medum poson. The mehod of k-averaged of cluser analyss was appled n analyss of nensy of daa raffc n seleced me nervals whle usng Sascal Package for Socal Scences 407

2 L. Kaklauskas L. Sakalauskas (SPSS). The mehod of non-herarchc cluser analyss was appled when he amoun of cluser fgures (k=24) s known and dsances beween clusers and objecs are calculaed by usng Eucldean square range mercs. Ou of 309 seleced measuremen sequences 6 seres groups were formed oally 854 seres; measures of each hour were used. The me seres obaned corresponds o measuremens performed n me momens... here n s an amoun of saved packes and nervals beween are unequal.e. 2 n + where [ n]. Daa packes 2... n n ceran me perods characerse busness of he channel n varous me momens. In order o analyse such me seres mus be aggregaed.e. o calculae daa raffcs n equal me nervals = +. For aggregaon of daa wo mehods were chosen: average raffc for a daa seres was calculaed n a chosen me nerval and he sum of daa raffc n me momens : [ k k ] k = k = here k = k +. [ k k Aggregaed me seres whle esmang nework raffc are marked as follows: lowes raffc he average raffc and ] ma ma mn he hghes raffc when mn he [ s]. For esmaon of me seres he programme Fracan 4.4 worked ou by V. Sychov n 2003 was appled [5]. In he aggregaed seres he programme calculaes he followng: correlaon and phasc space measure auo-correlaon funcon by snglng an opmal me lag ou correlaon enropy Hurs coeffcen and fracal measure; presens a graphc mage of numercal values and draws obaned aracors. 3. Research of nework raffc me seres For analyss of formed me seres he chaos heory s he mos suable; was scenfcally reasoned and sared o be developed by E. Lorenz (Massachuses Insue) n hs works of he lae second decade and a French-Amercan mahemacan B. B. Mandelbro [8]. The man nsrumens of hs heory are aracors and fracals whch end o descrbe dynamc syse dsregardng classcal heores. An aracor s a geomerc fgure characersng behavour of a sysem n phasc space when me draws closer o nfny. Phasc space s an absrac space he coordnaes of whch defne degrees of he analysed sysem s unresran. The srange aracor bears ceran mamum l characersed as aracor s dmenson and s geomerc epresson s a fracal. Then for evaluaon of he srange aracor one can apply he followng feaures of a fracal: symmery whch defnes self-smlary; and a fracal measure whch s epressed hrough a fracon s a mahemacal measure of fracal s naccuracy [4 8]. mn =00 =500 =s =00 =500 =s ma Fg.. Characersc aracors obaned whle analysng aggregaed seres For esmaon of aracors dmenson we calculae Hausford measure D [4]: Ths measure s called a fracal measure. We analyse he sysem when <D<2 hen he formula for calculaon s:. 408

3 APPLICATION OF CHAOS THEORY TO ANALYSIS OF COMPUTER NETWORK TRAFFIC ln N D= here N amoun of elemens used for measuremen of fracal s undulaon N 2 when ln(/(2* r)) a fracal s n plane r radus of a crcle used n 2-dmensonal space. In compuer neworks a fracal measure characerses dynamcs of formed daa raffc me seres changes when D [2 ] and one varable s used 854 chars were drawn and analysed. Afer carryng ou analyss was esmaed ha he aracors obaned belong o he group of he srange aracors. Fgure demonsraes characersc aracors when daa raffc n he compuer nework s mnmal medum and he hghes. Graphc spheres of all he aracors are close and arbued wh symmery. Ths allows us drawng a concluson ha he me seres analysed are arbued wh self-smlary. Le us sae s an aggregaed seres X of he analysed nework raffc whch s obaned by smoohng accordng o averages and summng n equal me nervals n where [ n]. I s saed ha he process X s arbued wh long-range dependence f he equaon s sasfed: β L ( ) r( k) k L ( k) when k 0 < β < and Lm = > 0 where L () s a consan or a funcon L ( ) long-range changng n nfny e.g. a logarhmc funcon. r(k) s an auo-correlave funcon calculaed accordng o he classcal formula: + ( X X )( X k X ) r( k) = X average of a seres X σ 2 ( X ) dsperson when N 2 σ ( X ) k Z+ = {2...}. Such process s descrbed by an auo-correlave hyperbolcally decreasng funcon. I s saed ha he process X s arbued wh shor-range dependence f he aggregaed process and nonaggregaed X are descrbed by a shor-range eponen formula: r( k) ρ k 0 < ρ < [4]. For he me seres analysed phasc space P and correlaon measure C were calculaed accordng o nework load: he lowes mn mn average k and he hghes ma ma. Research proves ha f me seres phasc space measure s defned by fne numbers shows ha he analysed process defnes deermned chaos and s analycally descrbed by usng a leas P amoun of dynamc varables. Calculaed phasc space measures for he seres are appromaely 6.72 and e The calculaed numercal epressons are fne; and correlaon measures 0.9 esmaed analycally as well.e. for every seres group accordng o he me nerval he average medan sandard devaon and dependen nerval wh relably of 95% were calculaed. Esmaon resuls: P [ ] C [ ] Md [ ] Md [64] [ ] P C σp σc [ ]. Every me seres has an obaned fne number whch characerses he phasc space measure and correlaon measure. Dependen nervals show ha he phasc space measure s fne and changes from 3 o 0 dependng on me nerval and aggregaon mehod. The correlaon measure changes from 3 o 8.e. correlaon negral s fne. Accordng o resuls of hs research we can sae ha aggregaed me seres descrbe deermned chaos wh fne amoun of dynamc varables. 4. Esmaon of Hurs sascs Hurs coeffcen characerses wheher he seres analysed s random wheher has a shor-range or long-range dependence. Influence of he curren process on fuure evens s calculaed by esmang s 2H correlaon [2 4]: C = 2 where C correlaon measure o H Hurs coeffcen. Whle evaluang self-smlary of a me seres he value of Hurs coeffcen.e. nerval where occurs s very mporan. If Hurs coeffcen H=0.5 means ha sequence members are random and every subsequen s member does no depend on prevous seres members. If 0 H < 0. 5 hen he process characersed by he me seres s an-dspersve.e. we can sae ha f ncrease s observed n one perod n oher perod decrease wll defnely follow and he probably s he hgher he closer H s o 0. In hs case correlaon s negave and draws closer o 0.5. Such seres usually bear a feaure of hgh changeably and are formed of frequen ncreases and decreases. If 0.5<H <. 0 hen s a perssen 409

4 L. Kaklauskas L. Sakalauskas process wh long-erm memory.e. n he pas he process had a feaure for ncrease and wll rean hs n fuure wh he hgher probably he closer H s o and correlaon wll draw closer o. Usually such seres are called rend-ressan whle H draws closer o 0.5 he amoun of rends (noses) ncreases n he seres. For formed and aggregaed me seres n he nework node Hurs coeffcen s calculaed accordng o he formula H= log( R / S) / log( n / 2) where H Hurs coeffcen R/S r/s sascs acqured accordng o he formula: R Ma( ( )) Mn( ( )) R( / S = = = = here n where n amoun S( n n = ( 40 2 ) of sequence members average value of he seres and ( ) he formed cumulave = seres descrbng he sum of changes hroughou me. Accordng o Hurs (95) we can sae ha he R( epresson s suable for majory of naural phenomena: M ~ cn H n where c consan S( ndependen value a consan [3]. I was esmaed ha when amoun of seres members (amoun of monorng) ncreases Hurs coeffcen draws closer o he value of 0.5.e. he memory effec decreases. Hurs coeffcen s closely relaed wh he fracal measure D whch characerses local feaures of compuer nework daa raffc and Hurs coeffcen descrbes characerscs of he whole process memory of he process. In self-smlar processes local feaures are refleced n global ones and vce versa; because he me seres measure N= herefore he connecon can be esmaed by usng he formula: D=2-H where D fracal measure H Hurs coeffcen. Esmaed resuls show ha more han 80% of me seres 0.5<H<.0 herefore we can sae ha he processes analysed are perssen wh long-range memory. In order o fnd ou wheher analysed nework processes rean her feaures when aggregaed seres me nervals and nensy of daa raffc change he obaned Hurs coeffcen values were compared wh dfferen seres parameers. Afer carryng ou calculaons wh dfferen me nervals [ ] and dfferen nework loads mn ma he formed seres rean her feaures.e. f a seres was arbued wh a longrange memory he same endency remans wh modfed parameers. D. 27 shows ha he seres analysed are arbued wh fracaly; ha s why hey bear he feaures characersc o fracals. The calculaed numercal epressons are esmaed analycally as well.e. for every seres group accordng o he me nerval he average medan sandard devaon and dependen nerval wh relably of 95% were calculaed. Esmaon resuls: H [ ] D [ ] Md H [ ] Md D [0.2.4] σh [ ] σd [ ]. Hurs coeffcen changes from 0.6 o 0.79 hus he process of ransferred va compuer nework daa ha s descrbed by aggregaed seres s a perssen process wh long-range memory. Fracal measure D changes from.23 o.82 and dependen nervals are very narrow and hs proves ha calculaed values are relable and fraconal epresson of he fracal measure suggess ha he seres bear feaures of fracals. Ths proves he conclusons drawn afer analyss of seres aracors. Afer generalsng research daa of hs secon we can sae ha he nvesgaed me seres characerse perssen processes wh long-range memory. Conclusons. Afer carryng ou research of smoohed and summed up nework me seres was esmaed ha her aracors belonged o he group of he srange aracors hus he me seres nvesgaed are arbued wh self-smlary. 2. Analyss of he auo-correlaon funcon proves ha aggregaed me seres are arbued wh longrange dependence. 3. Relably measures for calculaon resuls show ha he phasc space measure s fne and seres descrbe deermned chaos.

5 APPLICATION OF CHAOS THEORY TO ANALYSIS OF COMPUTER NETWORK TRAFFIC 4. Measures of Hurs coeffcen relably prove ha he aggregaed seres descrbe a perssen process wh long-range memory. I was proved by analyss of Hurs coeffcen chars. References [] Leland E.; Taqqu S.; Wllnger W.; Wlson D. V. 994.On he Self-Smlar Naure of Eherne Traffc. IEEE/ACM Transacons on neworkng 2( February). [2] Beran J Sascs for Long-Memory Processes. Capman&Hall/CRC USA. [3] Park K.; Wllnger W Self-Smlar Nework Traffc and Performance Evaluaon. John Wley & Sons USA. [4] Olsen L Revew of Inegral probably and fracal measures by G Edgar (New York 998) Bull. Amer. Mah. Soc. 37 (4): [5] Self-smlary h.u. [neracve]. [Accessed on ]. Accessed va he Inerne: <hp:// ru/nde.php> [6] Userspace loggng daemon. [neracve]. [Accessed on ]. Accessed va he Inerne: hp:// [7] Samorodnsky G Long Range Dependence. Foundaons and Trends n Sochasc Syse (3): [8] Sheluhn O. I.; Smolsky S. M.; Osn A. V Self-smlar Processes n Telecommuncaons. John Wlley & Sons Ld. 4