The self-similar burstiness of the Internet

Transcription

1 NEM12 12//03 0:39 PM Page 1 INTERNATIONAL JOURNAL OF NETWORK MANAGEMENT Int. J. Network Mgmt 04; 14: (DOI:.02/nem.12) 1 Self-similar and fractal nature of Internet traffic By D. Chakraborty* A. Ashir, T. Suganuma G. Mansfield Keeni, T. K. Roy and N. Shiratori The self-similar bursty Internet traffic is usually characterized by the Hurst parameter (H). Such a process is also seen to possess fractal characteristics in time described by a parameter (b), with multifractals in most cases. We observe that these highly stochastic traffics have fractals in flow density too, described by a fractal dimension (D), also with the possibiliy of multifractals as in the former. This requires another parameter for the description of Internet traffic, besides the usual selfsimilarity parameter b or H and the different simulations or models worked out to understand the Internet traffic to reproduce the characteristics as found in the present work. We also find a notable selfsimilarity feature of the autocorrelations in the data and its aggregates, in all the cases studied. Copyright 04 John Wiley & Sons, Ltd. 1 Introduction The self-similar burstiness of the Internet traffic almost at all time scales, having slowly decaying autocorrelations with time, the so-called long-range effect and 1/f g power spectrum at low frequencies, are all manifestations of the critical condition of the system arising due to jamming effects at the gateways and their neighbours through which packets of information are processed. 1,2,3 After the pioneering works of Leland et al. 4 and Casabi, numerous works have appeared in the literature confirming the self-similar and fractal nature 6 11 of Internet traffic data, also with the possibility of multifractals in time resolution. The fractal properties are a consequence of jamming conditions in the Internet 1 3 and possibly, fractal structure of its networks. 12 Understanding the Internet traffic is an open and challenging problem, more so after the familiar Poisson model, which used to be applied to problems in telecommunications, showed cracks in characterizing the Internet traffic with the start of fascimile services Without an appropriate model for the Internet traffic it is impossible to obtain the insight that is required to efficiently plan, manage or operate a network to render a satisfactory quality of service to the users. Although parsimony in models is desired the Internet traffic, due to its complicated structure and stochastic behaviour, may require a number of parameters for the characteristics that specify its behaviour. In this paper we report that the Internet traffic possesses fractals in flow density (bytes transmitted per unit time) too, with the number of boxes at a certain resolution to cover the range of data following a power law. We also show that the auto- 2 3 *Correspondence to: D. Chakraborty, TAO Tohoku University Office, Sendai, Japan. deba@shiratori.riec.tohoku.ac.jp Tel: ; Fax: Copyright 04 John Wiley & Sons, Ltd.

2 NEM12 12//03 0:39 PM Page 2 2 D. CHAKRABORTY ET AL correlations of the characteristic time-series data follow a notable self-similar behaviour, a feature which has not been reported so far. The Internet traffic being an example of a system composed of many stochastic components, it will also be interesting to see whether other similar natural systems 13 follow similar characteristics to those that we present here. In the following paper, after a brief account of related work and statistics of self-similarity in a time series, we describe how the fractal characteristics of the flow density data can be determined. We then describe the arrangement for data collection in our laboratory and give the results of our studies on, along with our data, other data sets, 4 6,14 1 which belong to traffics of either LAN or wide-area networks, all showing self-similarity. Finally, we conclude with a summary and a note on possible areas of further research. Related Work Leland et al. 4 and Casabi were first to show that Internet traffic had self-similar features. The former group had measured Ethernet traffic flows with errors 0ms and a survey of their data consisting of several hundred millions of packets confirmed the self-similar behaviour of the traffic over a wide range of time scales. This was contrary to the traditional idea of the Poisson model, in which the data smooth out and become featureless over large time scales. The distribution of the traffic was similar irrespective of the time scale of observation. All of them had similar long-range behaviour of the autocorrelations, decaying slowly according to a power law. This was confirmed by Paxson and Floyd 6 and Crovella and Bestavros 7 in the case of wide-area traffics also, and they suggested that the cause was related to the heavy tail distribution (of Pareto type) of the bytes transmitted. Willinger et al. 8 also had similar observations related to the high variability of the Internet traffic data. Taqqu et al. examined in detail the traffic at higher resolutions and observed that the Internet traffic is multifractal, that is, at these resolutions, the characteristics of the data, remaining selfsimilar, have different parameters. Contemporary to Leland et al. 4 Casabi measured the round-trip-time (RTT) of the packets in the network and observed the 1/f law of the power spectrum of the RTT distribution. This was examined in detail by Takayasu et al. 1 3 and they proposed a model of contact process, by which they were able to show that the traffic follows a 1/f behaviour but only during the critical condition. Away from the critical condition the power spectrum at low frequencies have a 1/f 2 distribution instead. Their simulations of the traffic based on a tree model show that due to jamming conditions, when the demand for transmission exceeds the capacity of the links, the Internet can exist in a critical condition during which the network is most efficient. At the critical condition the traffic shows self-similar and fractal features. The nature of the flow densities in Internet traffic has not been reported earlier. An additional fractal feature we present in this paper relates to the nature of the flow densities in Internet traffic, which has not been reported earlier. We describe this, along with other interesting features, in a later section. Preliminary reports of our work can be found in references Characteristics of Internet Traffic Data Modern Internet traffic measurement systems 4, record the time, with errors 0ms, at which a packet of information arrives along with other details such as the source, destination, etc., and the byte length of the data transferred. From this record, a time series of the data transmitted per unit time interval (flow density) is obtained. The self-similarity of the traffic relates to, and is defined in terms of, aggregates of this time series. Statistics of Self-similarity For a self-similar time series: { X} = { X1, X2,..., X N }, the m-aggregate {X (m) } with its kth term: (1) Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

3 NEM12 12//03 0:39 PM Page 3 SELF-SIMILAR AND FRACTAL NATURE OF INTERNET TRAFFIC 3 (2) has its variance Var[X (m) ] related to original Var[X] as: Var[ X ( m ) ] = Var [ X ] m, 0 < b < 1 (3) b being the self-similarity parameter. b initially may have a different value from that to which it settles down with m. Another characterization of self-similarity is given by 16 the rescaled range (R/S) of the data, where R(N) is the range of a series {L} defined as: L = ( X - m( N) ),1 j N j ( Xk m ) =  Xi m, j  i = 1 i= m( k-1)+ 1 i km (4) with m(n), the mean of data of size N and S(N), the usual standard deviation. The R/S plot follows a power law at large N for a self-similar process: H RS~ ( N2), H> 0. () where H is the Hurst parameter. This is an extension of the Brownian-motion process where the average distance traversed by a Brownian particle varies as N 1 2. Most Internet traffic data show a value around 0.9 for H. 4 It is to be noted that H gives a measure of self-similarity independent of the time scale of observation since the series L j and L (m) j from original and m-aggregated series are expected to produce same H. b (the asymptotic value) is related to H as: 4 b H = 1-2 (6) so that for full similarity (b = 0), H = 1 and for noise, which has no self-similarity (b = 1), H = 0.. The autocorrelation R(k) = X i X i+k Ò, the average of product X i X i+k, is supposed to be independent of m 4 for such a process: ( R m ) ( k) = R( k) (7) i.e. the original series and the m-aggregates give the same autocorrelation, which is difficult to observe if the data set is not large. However, at large k it is found to decay slowly (remains locally constant) according to a power law, hence the term covariance stationary (due to b < 1): -b Rk ( ) ~ k, klarge. b (8) Due to this long-range behaviour the power spectrum S( f ) at frequency f related to R(k) as: -ikf  k Sf ( ) = Rke ( ) also follows a power law at low frequencies: -g Sf ( Æ 0) ~ f, g = 1-b Fractal Characteristics of Internet Traffic Data (9) () We define 17 a process to possess fractal characteristics, if there exists a relationship of the form: Q( t) µ tfd ( ) (11) where Q is a quantity depending on t, a resolution in time or space of observation variables and F(D), a simple function (most often linear) of the dimension D, a non-integer, of the process, the fractal dimension. Due to extreme variability, the Internet traffic data exhibit such fractal-like structures over a long range of time scales. In fact one of the measures of self-similarity is based on such a definition. When Q is the variance of data, then F is -b, so that the fractal dimension D is identified to be b: ( ) -b Var[ X m ] µ m (12) Thus (12) describes a fractal behaviour of data in time. Equation () is another similar description. The case of multifractals refers to that situation when the exponent (b) varies from one range of scales (m) to another. We observe that a similar description of data {X} of (1) or {X (m) } of (2) can be found with the resolution in the magnitude of data. Imagine the range of data {X} to be divided into equal segments of size e, and we count the number of segments that contain the data. Let this be N(e). Then if (see for example 18 ) N( e) µ e - D (13) then the dimension D at resolution e can be obtained from the slope of log N(e) vs. loge. Thus the set {X} or {X (m) } is fractal if (13) is valid over an appreciable range of scales. For random data, since all values are equally likely, D = 1. Thus (13) gives an indication that all values in the Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

4 NEM12 12//03 0:39 PM Page 4 4 D. CHAKRABORTY ET AL. 1 2 range of data are not equally probable if D is a fraction. As in all natural cases, 19 it is to be noted that (13) is expected to give the dimension for a range of scales depending on the volume and accuracy of data. Again, here also multifractals can exist with the exponent Ds depending on the scales (e) of observation. Internet In Out data collector Tohoku University Campus Network [622 Mbps] 0 Mbps Shiratori Lab LAN /26 Figure 1. Data collection point at Shiratori laboratory LAN Results and Implications Data Collection Environment In addition to data collected from different sources 4 and, 6,14,1 we also made arrangements to test the self-similar nature of Internet traffic in our communications laboratory, Shiratori Laboratory (SL) of RIEC, Tohoku University. Figure 1 shows the data collection point of SL LAN. SL LAN is a 0 Mbps Ethernet link connected to the Tohoku University ATM campus network (622 Mbps). It is equipped with servers and 0 users. The traffic traversing the network originates mainly from Web, ftp and mail services as well as some experiments carried out in the laboratory. Two types of flow were recorded, all inbound octets from the rest of the world to SL and all outward octets from SL to the Internet in time intervals of 1 minute between 1 February 00 and 29 February 00, a busy period in the University. Table 1 lists, along with our data, various Internet traffic data sets that we studied, with collection periods ranging from 1 hour to about 1 month and time intervals Dt, 2-7 second to 1 minute and average flow densities varying over a wide range, from 1 byte to about 00 Kbytes per second. The time series {X}, of (1), i.e. transmitted bytes per interval of time Dt was obtained from the transmitted packet length vs. time stamp records by a Data Ref. Resolution Duration Data type Average flow BC-Oct 89Ext s 34 h Ext Bytes/s BC-Oct 89Ext s 21 h Ext Bytes/s BC-p Oct s 29 min LAN KBytes/s BC-p Aug s 2 min LAN KBytes/s DEC pkt s 1 h tcp KBytes/s DEC pkt s 1 h tcp KBytes/s DEC pkt s 1 h tcp KBytes/s DEC pkt s 1 h tcp KBytes/s LBL pkt s 2 h tcp KBytes/s LBL pkt s 2 h tcp KBytes/s LBL pkt s 2 h tcp KBytes/s MAWI 14 ms 1 h All 437. KBytes/s SSOO 1 1 min 29 days OutOcts 2.6 KBytes/s SSIO 1 1 min 29 days InOcts Bytes/s Abbreviations: Ext, external arrivals; All, all packets; pkt, packets; OutOcts, all out-octets; InOcts, all in-octets; Kbytes, 24 bytes. Table 1. Traffic data profile Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

5 NEM12 12//03 0:39 PM Page SELF-SIMILAR AND FRACTAL NATURE OF INTERNET TRAFFIC program. The BC-p data correspond to LAN during busy hours and the rest belong to WAN traffics. Descriptions of these data can be found in the cited references. The SSIO and SSOO data correspond to, respectively, all in-octets to SL and all out-octets from SL as mentioned above. log Var[m] (b) Data LBL-BC-Oct89Ext log m (a) Figure 2. Temporal multifractals of data BC-Oct89Ext (Dt = 2-7 s, 4 ) with (a) b = 0.19 (m = 2 6 ~ 2 14 ) and (b) b = 0.61 (m = 2 0 ~ 2 6 ). Observed Characteristics Self-similarity from change of variance: temporal multifractals All the data sets show (in Table 2) high self-similarity as shown by the values of H except the last one (SSIO) which was not so (b ª 1). Most of the cases have temporal multifractals (as in Figure 2) described by bs in the respective scales given by the range of ms (in Table 2) and as earlier reported 6 11 these could be found in the data sets with small Dt. The low value of b in certain ranges of time scales show that at these resolutions the processes look most self-similar, which may be of help in a prediction process. There is a general trend to have higher values of b at higher resolutions (low m). We also found that these multifractals remained almost constant or very slowly changing in time, one of them being shown in Figure 3. Here b was calculated over a sliding window of 26 K data (1 K = 24 bytes) corresponding to a flow of 32 min. approximately. This window sliding after 8 min. (approximately) would discard the previous 64 K data and add in a new set of the same length. Thus in this way we can get a variation of b with time and this can be applied in the case of on-line determination also. Since our laboratory data were taken at intervals of 1 min, and hence volume of data was not large, the time dependence of the parameters could not be determined for small time Data BC-Oct89Ext (LBL) beta f.d 3 beta and f.d time (1 unit = 12 s) Figure 3. b and fractal dimension D (f.d) for data BC-Oct89Ext of LBL, 4 calculated over a sliding time window of 48 s, after every 12 s, showing that these parameters remain almost constant in time. The bs correspond to low-time resolutions (m = 2 0 ~ 2 6 ) Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

6 NEM12 12//03 0:39 PM Page 6 6 D. CHAKRABORTY ET AL. 1 2 Data H b 1 b 2 b 3 D 1 D 2 D 3 scales (m) scales (m) scales (m) scales (m) scales (m) scales (m) BC-Oct Ext (2 1 2 ) ( ) ( ) ( ) BC-Oct Ext4 ( ) ( ) ( ) ( ) ( ) ( ) BC-p Oct89 ( ) (2 4 2 ) ( ) (2 0 ) (2 8 ) (2 12 ) BC-p Aug89 ( ) ( ) (2 0 ) (2 8 ) (2 12 ) DEC pkt-1 ( ) ( ) (2 0 ) (2 8 ) (2 12 ) DEC , 0.37 pkt-2 ( ) ( ) ( ) (2 0 ) (2 8 ) (2 12 ) DEC pkt-3 ( ) ( ) (2 0 ) (2 8 ) (2 12 ) DEC pkt-4 ( ) ( ) (2 0 ) (2 8 ) (2 12 ) LBL pkt-3 ( ) ( ) ( ) ( ) ( ) LBL pkt-4 ( ) ( ) ( ) ( ) ( ) (2 12 ) LBL pkt- ( ) ( ) ( ) ( ) (2 12 ) MAWI , 0.48 (2 1 2 ) ( ) (2 0 2 ) (2 12 ) SSOO ( ) ( ) SSIO ( ) (2 0 2 ) (The blank places in the table imply that multifractal characteristics were not found in these cases.) Table 2. Multifractals b s and D s of Internet traffic data in different ranges of time scales (m s) windows (as in Figure 3). But averaged over a sliding window of about 1 days (with a set of 16 K data) after every 2 days (corresponding to an interval of 2 K data), b for both SSIO and SSOO were found to be almost constant in time. Nature of autocorrelations of m-aggregates The autocorrelation R(k), the average of product X i X i+k, initially shows a hyperbolic fall-off as in (8), but at larger k it is full of structures like the data. We find a notable selfsimilarity when we compare the plots for different m-aggregates (Figure 4). As a test of self-similarity, Leland et al. 4 observed the m-independence of (7), obtained from different m-aggregated series all of same length. This requires a data set over a long duration. We observe that given an unaggregated series of length N (say), from which different m- aggregated series each of length N m = N/m are obtained, the autocorrelations R (m) (k) for m and k large follow: ( m R 1) ( m k R 2) ( (14) 1) = ( k2), mk 1 1= m2k2. The higher and in most cases all the m- aggregated series give the same autocorrelations in terms of actual time (mk), which is easier to verify and more practical (we tested as far as mk = N/2 for all the cases studied). This does not occur for an ordinary data, noise or a signal from a dynamic system that is not self-similar. Thus we have a different indication of self-similarity also useful for verification in a small data set the autocorrelation plots at higher, and in most cases all, levels of aggregation look similar as in (14). As a matter of Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

7 NEM12 12//03 0:39 PM Page 7 SELF-SIMILAR AND FRACTAL NATURE OF INTERNET TRAFFIC 7 Autocorrelations for BC-Oct89Ext (m) R (k) 3 m=16 m= Figure 4. A typical R (m) (k) vs. mk, m = 16 and 26, plotted at mk = 0(26)48.26 for comparison mk 2 fact when we tested with artificial data (obtained by inverse Fourier transformation) from a power spectrum around 1/ f g (a signature of critical behaviour) with random deviations and having random phases, we do find such self-similarity of the autocorrelations for all m-aggregates. This fact coupled with (7) makes the autocorrelation function itself self-similar and fractal-like, a feature leading to the data (flow densities) forming a fractal set, which we shall discuss below. With increase of time resolution the details of the autocorrelation come out preserving the previous values. On closer inspection, we do find them to be self-similar and fractal-like (which cannot be described by H or b alone). Fractal dimension of flow density data: a new parameter of Internet traffic In order to determine the fractal dimension D of (13), we normalize a dataset to the range [0, 1], which is divided into 2 k segments (or boxes) each of size e = 2 -k. If a datum has value X, then it is kept in box number Integer(X/e). The box counting method counts the number of boxes N(e) that contain data (some of these may contain more than one datum) and determines D from the log log plot of N(e) vs. e. All the data sets show fractal behaviour of flow densities. The scaling described by (13) works for an appreciable range of precisions (more than two orders of magnitude in all the cases studied), but with D depending on the time resolution like the bs (as shown in Table 2 by D 1, D 2, etc., in time scales given by range of ms). In general, D decreases with m which implies clustering of data when viewed in larger time scales. In some cases, for example in the LBL-BC (Figure ) and LBL-tcp packets, multifractals appear as the time resolution is decreased, gradually switching over to another dimension at higher m. The 1-hour DECtcp packets appear to have a random behaviour (with D ª 1 at low m), the difference being notice- 3 Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

8 NEM12 12//03 0:39 PM Page 8 8 D. CHAKRABORTY ET AL. 1 2 log N(eps) in arbitrary units m m=96 = Data LBL-BC-Oct89Ext m = 26 m = 16 m = 1 D2(96) D1(26) D2(26) D1(16) D1(1) log (eps) in arbitrary units D1(96) Figure. Multifractals of flow density (data BC-Oct89Ext, Dt = 2-7 s, 4 ) at time resolutions m = 1(D = 0.8), 16(D = 0.84), 26(D 1 = 0.81, D 2 = 0.7) and 96(D 1 = 0.81, D 2 = 0.). Data is normalized to [0, 1] and the range of scales in the figure correspond to 2 - to able only at higher ms. An important point to note is that although a finite set of random data tends to form clusters with m-aggregates, thereby apparently forming fractals, they do not give rise to sharp multifractals we observe here (as in Figure ). The fractal dimensions of the aggregates of a set of random numbers (of same volume as data) change (from D = 1 at m = 1) at a slower rate with m, probably due to the drop of variance being faster. In these stochastic processes, with the variation of m either there is a faster rate of change of D or multifractals appear with the previous dimensions (almost) unchanged. We verified that appearance of these multifractals with aggregating is not due to artifact that the data size is reduced. For the m = 26 case of BC- OctExt data (of Figure ) with datasize 64 K (corresponding to data of 32 hours approximately), we find similar multifractals with D 1 ~ 0.7, D 2 ~ 0. for data sizes 32 K and 16 K (data of 16 hours and 8 hours approximately), slightly different from that obtained from the whole dataset, with D 1 = 0.81, D 2 = 0.7. For m = 96 (data size 4 K) we find a greater range of scales for D 2 ~ 0.7. Thus there is a tendency to switch over to a fractal with lesser D at larger time scales. While this data size may seem to be insufficient apparently showing multifractals we note that this feature at such low resolutions is obtained for other datasets also (Table 2) such as MAWI (resolution s), SSIO and SSOO (60 s) all with datasize > K and D ~ 0.. We have tested that although the 1/ f g law of () gives rise to fractals like b and D, multifractals in both time and flow density resolutions cannot be obtained from such a power spectrum (even with large fluctuations up to 0%). For this it is necessary to identify the features in simulations of Internet traffic (such as in 1,2,3 ). We also studied the variation of these features with time, and a typical result is shown in Figure 3. In most cases, the fractal dimension was a constant or very slowly changing in time depending Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

9 NEM12 12//03 0:39 PM Page 9 SELF-SIMILAR AND FRACTAL NATURE OF INTERNET TRAFFIC 9 9 Data SSIO, D=0. log N(eps) [arb. units] log (eps) [arb. units] Figure 6. Fractals in flow density of data SSIO, Dt = 60s 2 on the time resolution of observation only. This indicates that these stochastic processes follow fixed dynamics. In some cases, for example in BC- Oct89Ext and BC-Oct89Ext4 data of LBL, we find that if we treat the byte size of the packets as a series irrespective of the time of flow, we have a fractal structure in the data with D ª 0.7, which also remains a constant in time. The same holds for the LBL-tcp packets (3, 4 and ) also, with D ª 0.8. We find similar descriptions of some stochastic processes in the excellent collection of Briggs. The other cases which show D ª 1.0 indicates that it is the pattern of inter-arrival times that makes the equal-interval time series fractal. The statistics of the inter-arrival times need to be worked out to get a clue to this feature. The Internet traffic, therefore, appears to have another parameter of description, which is its fractal dimension D, depending on the time resolution (a convention of which may be set to specify D). As seen in Table 2, two sets of data (with same Dt) having more or less the same b (or D) are differentiated by the other parameter D (or b). The case of SSIO, which has a convincing fractal characteristic, is interesting (Figure 6), but there is much less temporal self-similarity (b 0.9). Usually b 1 represents noisy data with no fractal-like behaviour, but in this case we find a consistent fractal characteristic (over an appreciable range of precisions) given by D 0.0. In this case although the autocorrelations of different aggregates (Figure 7) appear to have features similar to that of random data and self-similarity not so pronounced as in other cases, it is not noisy. Conclusion and Future Research We have shown that given Internet traffic time series data of length N (say) from which are obtained its m-aggregates each of length N/m, there is self-similarity in autocorrelations from such aggregates as R (m) (k) = R(mk) (m and k large), i.e. the autocorrelations from different m- aggregates are the same in terms of actual time (mk). This does not occur for an ordinary data, 3 Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

10 NEM12 12//03 0:39 PM Page D. CHAKRABORTY ET AL. [arb. units] Data SSIO m=1 m=8 m=32 (m) R (k) Figure 7. R (m) (k) vs. mk, m = 1, 8 and 32 for data SSIO, Dt = 60s noise or a signal from a dynamic system which is not self-similar. Such an indication is also useful for verification of self-similarity in a small data set. Similar to b, which gives the rate of decrease of variance of m-aggregated data, the flow density is also seen to be fractal with dimension D, depending on time resolution of observation. This provides the Internet traffic with another parameter of description, the fractal dimension D of the dataset, besides the commonly used self-similarity parameter b. Multifractals are also possible in both the cases, especially from data of high resolution in time (of the order of 1 ms). These parameters, remaining almost constant or very slowly changing over time, give a hint that the dynamics of the process is fixed. Thus, it is also required that the different simulations or models worked out to understand Internet traffic, reproduce these fractal descriptions as found in the present work. Another important point to note is that in nature we have, similar to Internet traffic, other traffic systems (for example vehicular traffic) or stochastic flows (like the water drainage in a river) and growths, and it is expected that such systems will also follow behaviour similar to that we observed here. It is expected that, in nature, other systems will follow behaviour similar to that observed here. Application of self-similarity features to Internet traffics and further extension of our work are possible by working out the following problems: 1. Understanding the characteristics of these self-similar stochastic processes may be of help in a statistical prediction of the flow useful to the network manager to render a mk satisfactory quality of service. In statistical prediction although the ARIMA method 21 is in practice, further accuracy could be achieved if self-similarity features were taken into account. This could be done by a simultaneous fitting to original and aggregates with the same set of parameters. 2. The characteristics may be of use in differentiating traffic that is not natural, which may be due to the intruders 22 in networks or an abnormal traffic situation in a busy city. The change of nature of traffic will probably result in a change of its characteristics. Since the calculations to determine the characteristic (b and D) require little CPU time, an in-situ determination of abnormal traffic may be possible by noting the change of parameters. 3. The cause of flow density data having such fractal structures as described by dimension D, dependent on time resolutions, is not yet understood. So other interesting work will be to look for a description of the system that reproduces these parameters. 4. In simulations of Internet traffic, such as the phase-transition model in networks worked out by Takayasu et al. 1,2,3 it will also be interesting to see what happens to the selfsimilarity and fractal structure of the flow densities at situations away from the critical point in such a model. This is essential since network performances are expected to be best near the critical condition, 1,2,3 which may be identified by the variation of these parameters. References 1. Takayasu M, Takayasu H, Sato T. Critical behaviors and 1/f noise in information traffic. Physica A ; Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

11 NEM12 12//03 0:39 PM Page 11 SELF-SIMILAR AND FRACTAL NATURE OF INTERNET TRAFFIC Takayasu M, Takayasu H, Fukuda K. Dynamic phase transition observed in the Internet traffic flow. Physica A277 00; Fukuda K, Takayasu H, Takayasu M. Origin of critical behavior in Ethernet traffic. Physica A287 00; Leland WE, Taqqu MS, Willinger W, Wilson DV. On the self-similar nature of Ethernet traffic. IEEE/ACM Transactions on Networking Feb. 1994; 2(1): 1 1. (Data collected from: gov/html/contrib/bc.html.). Casabi I. L/f noise in computer network traffic. J. Phys. A: Math. Gen. 1994; 27: L417 L Paxson V, Floyd S. Wide area traffic: the failure of Poisson modeling. IEEE/ACM Transactions on Networking June 199; 3(3): 226. (Data collected from: LBL-TCP-3, LBL-PKT}.html.) 7. Crovella ME, Bestavros A. Self-similarity in World Wide Web traffic evidence and possible causes. In Proceedings of Sigmetrics 96, 1996; Willinger W, Taqqu MS, Sherman R, Wilson DV. Selfsimilarity through high variability: statistical analysis of Ethernet lan traffic at the source level. IEEE/ACM Transactions Networking 1997; : Adler R, Feldman R, Taqqu MS. A practical guide to heavytails (Self-similarity and heavy tails: Structural modeling of network traffic). Birkhauser, Boston, February Taqqu MS, Teverovsky V, Willinger W. Is network traffic self-similar or multifractal? Fractals 1997; : Feldmann A, Gilbert AC, Willinger W, Kurtz TG. The changing nature of network traffic: scaling phenomena. In ACM SIGCOMM ; Comp. Comm. Rev. 12. Caldarelli G, Marchetti R, Pietronero L. The fractal properties of Internet. Europhysics Letters 00; 2: Mandlebrot BB, Van Ness JW. Fractional Brownian motions, fractional noises and applications. SIAM Rev. 1968; : WIDE group. (mawi of wide). 1. Data from Shiratori Laboratory RIEC, Tohoku University, (available on request, Hurst HE, Black R, Simaika Y. Long-term storage: An Experimental Study. London: Constable, Willinger W, Paxson V. Where mathematics meets the Internet. Notices of the Am. Math. Soc. Sept. 1998; 8(4): Schuster HG. Deterministic chaos: An introduction, 3rd edn. John Wiley & Sons, March Addison PS. Fractals and chaos: An illustrated course. Institute of Physics Publishing, Sept Briggs, J. Fractals: the patterns of chaos. Simon and Schuster, New York, Oct Box GEP, Jenkins GM, Reinsel GC. Time series analysis: forcasting and control, 3rd Edn. Prentice Hall, New Jersey, February Mansfield G, Ohta K, Takei Y, Kato N, Nemoto Y. Towards trapping wily intruders at large. Computer Networks 00; 34: Ashir A, Suganuma T, Kinoshita T, Roy TK, Mansfield G, Shiratori N. Network traffic characterization and network information services R&D on JGN. Computer Communication (in press). 24. Mansfield G, Roy TK, Shiratori N. Self-similar and fractal nature of Internet traffic data. In Proceedings of the 1th International Conference on Information Networking, Beppu City, Kyushu, Japan Jan. Feb. 01; Ashir A, Chakraborty D, Roy TK, Mansfield G, Shiratori N. Some characteristics of traffic data. In Proceedings of the International Conference on Electrical and Engineering, ICECE 01, Dhaka, Bangladesh January 01; Roy TK, Chakraborty D, Ashir A, Mansfield G, Shiratori N. Characteristcs of Internet traffic data. Workshop on Multimedia and Distributed Processing, Tokyo, Japan, 00; 12: If you wish to order reprints for this or any other articles in the International Journal of Network Management, please see the Special Reprint instructions inside the front cover Copyright 04 John Wiley & Sons, Ltd. Int. J. Network Mgmt 04; 14:

12 NEM12 12//03 0:39 PM Page

13 Author Query Form (NEM12) 12//03 0:39 PM Page 1 AUTHOR QUERY FORM Dear Author, During the preparation of your manuscript for publication, the questions listed below have arisen. Please attend to these matters and return this form with your proof. Many thanks for your assistance. Query Query Remarks References 1 AQ? Biographies for p. 1? 2 AQ? Pages? NEM12