Wavelets come strumento di analisi di traffico a pacchetto

Transcription

1 University of Roma ÒLa SapienzaÓ Dept. INFOCOM Wavelets come strumento di analisi di traffico a pacchetto Andrea Baiocchi University of Roma ÒLa SapienzaÓ - INFOCOM Dept. - Roma (Italy) baiocchi@infocom.uniroma1.it

2 Summary 2 + Introduction: what is the problem? + Traffic measurements in Internet + Self-similarity and Long Range Dependence (LRD) + The Discrete Wavelet Transform (DWT) + Application of wavelet based models Analysis of self-similarity Synthesis of aggregate traffic + References

3 Measurement vs model (Poisson) 3 # of packets per 100 ms intervals for 6 s # of packets per 1 s intervals for 60 s (Y axis has been multiplied by a factor of 10) # of packets per 10 s intervals for 600 s (Y axis has been multiplied by a factor of 10) # of packets per 60 s intervals for 3600 s (Y axis has been multiplied by a factor of 6)

4 Impact on performance 4 Mean queue length H=0.9 H=0.75 Poisson Utilizatiuon coefficient

5 Measurements (1/2) 5 LAN traffic Ethernet: aggregated and per session (Bellcore , Fowler&Leland 1991) also collected also for Token Ring (16 Mbit/s) and FDDI WAN traffic ( ) IP (packet level, transport level, application level) ATM (BellCore, SUNET) CCS network Frame Relay networks Often publicly available on Internet

6 Measurements (2/2) 6 Performance and traffic measurement activities Network Internet Measurement Infrastructure (NIMI) (Paxson 1998) Lawrence Berkeley National Laboratories (LBNL) - Network Research Group: Internet traffic archive ( Internet Performance Measurements and Analysis project (IPMA) ( Cooperative Association for Internet Data Analysis (CAIDA) ( National Laboratory for Applied Network Research (NLANR): Network Analysis Infrastructure ( Internet Traffic Report ( North Carolina State University (

7 LAN traffic 7 LAN traffic (Ethernet): first studies date back to 1991 aggregated traffic (Leland et alii, 1994) traces exhibit self-similar scaling from 10 ms to 100 s scales estimates of H range consistently in for measurements taken over four years ( ) individual user session traffic (Willinger et alii, 1998) extensive empirical evidence of the ON/OFF emission model the heavy tail property is strongly supported for both ON and OFF duration and it is robust with respect to their definition

8 Source-destination pairs in LAN 8 Teaxture plots (packet vs time for 1 hour, resolution 1 s) Source A (37582 packets) Source A - Destination B (20152 packets) Source A - Destination C (7497 packets) Source A - Destination D (5511 packets)

9 WAN traffic (1/2) 9 WAN traffic (Pax98, Pax95, Wil98, Fel98, Cro96) Much more complex analysis and variety of data sets packet level (aggregated or not) transport level (TCP connections arrivals, durations, carried traffic) application level (FTP, TELNET, SMTP, HTTP,É) end-to-end beahviour, loss and delay performance TCP level TCP connection arrival count exhibits linear scaling at scales above 1 s (especially due to Web related TCP connections)

10 TCP connections 10 ÒTextureÓ diagram

11 WAN traffic (2/2) 11 Application level The Poisson model only accounts for FTP and TELNET session arrivals (Pax95); it appears to hold also for ÒWeb sessionsó Strong experimental evidence exists that the amount of data carried over FTP sessions and HTTP connections and their duration have a heavy-tailed distribution Packet level Both packet and byte counts exhibit self-similar scaling over four time scales from hundreds of ms up a breakpoint occurs at about 500 ms with nonlinear scaling below These findings are robust to traffic mix (they hold for traces containing from 0% WWW packets in 1990, to 10% in 1994 and 32% in 1997)

12 Results 12 Statistical analysis of aggregated packet level traffic traces points out that self-similarity is essentially tied to heavy tails at application level and it applies only asymptotically (beyond a few hundreds of ms) Structural modeling of traffic Intuitive explanations of self-similarity and multifractality self-similarity is an additive property (superposition of many ON-OFF sources): user behaviour, application-specific features it holds at large time scales multifractality is a multiplicative property, most probably tied to details of the lower layers (IP, transport) it shows up at small scales

13 Notation 13 Consider a discrete time setting Y(t) = cumulative traffic process up to time t X(t) = increment traffic process at time t =Y(t) Ð Y(tÐ1); we assume X(t) is a wide sense stationary process γ(k) = autocovariance of X(t) X (m) = sequence obtained by dividing the original process X into non overlapping blocks of size m and averaging over each block mk ( m) 1 X ( k) = Xn ( ) m n= m( k 1) + 1

14 Self-similarity 14 Second order self similarity. X(t) is exactly second order self-similar with Hurst parameter H (1/2<H<1) if 2 σ H H H γ( k) = ( k+ ) 2 2 k + ( k ) , k 1 2 X(t) is asymptotically second order self-similar if ( m) H H H lim γ ( k) = ( k+ 1) 2k + ( k 1), k 1 2 m σ For a continuous time process self-similarity with 0<H<1 is deinfed by Y(t) = d a ÐH Y(at), for all positive a. The increments satisfy X = d m 1ÐH X (m) (ss in a distributional sense)

15 Long Range Dependence 15 A wide-sense stationary sequence X={X(t), t Z} with autocovariance function γ X (k) and spectrum Γ X (ν) is said to have LRD property if ( 1 α ) α X γ X f γ ( k) ~ c k ( k ) Γ ( ν) ~ c ν ν 0 with 0<α<1. Hence k γ X (k) = Connection between LRD and self-similarity: a zero-mean sequence has the LRD property iff it is second order asymptotically self-similar (with 1/2<H<1) and then α=2hð1 Intuitive meaning: LRD implies the persistence of past events effects

16 Heavy tails 16 A random variable V has a heavy tailed distribution if its survivor function decays according to a power law: Pr(V>u) cu Ðβ as u with 0<β<2 Connection between heavy-tails and self-similarity: consider N On-Off traffic sources with a 1/0 rate process R i (t) and heavy tailed On duration Pr(τ On >x) cx Ðα, x. Let Y ( Tt) = R ( s) ds N Tt 0 i = 1 For llarge N,T and H=(3Ðα)/2, Y N (Tt) behaves statistically as E[ τ ] On 1/ 2 H NTt + cn T B H () t E[ τon ]+ E[ τ ] Off N i

17 Example processes 17 Arrivals in (0,t) = A(t) = mt+ (am)b H (t), where B H (t) is a Fractional Brownian Motion (fbm) (parameters: m, a, H) quite extensive results on computer generation bounds for queueing performance available (Norros 94, Massoulie&Simonian 97, Narayan 97) M/G/ or poissonian arrival of bursts (parameters: λ, R, burst duration distribution) Fractional AutoRegressive Integrated Moving Average (f-arima) More models and many queueing analysis results in K. Park and W. Willinger eds. ÒSelf-similar network traffic and performance evaluationó, John Wiley, 2000

18 Detecting self-similarity 18 Estimation of Hurst parameter H Variance time analysis: plot of logvar(x (m) ) vs log(m); the asymptotic slope is an estimate of 2HÐ2 R/S analysis based on the rescaled adjusted range statistics on time span d; plot of logr/s(d) vs log(d) (pox diagram); the asymptotic slope is an estimate of H Periodogram analysis, based on the sample periodogram of the time series I(f): plot of log(i(f)) vs log(f) for f 0. The asymptotic slope is an estimate of 1Ð2H Whittle estimator (also confidence intervals) MultiResolution Analysis: plot of log(e[energy of Wavelet coefficients at scale j]) vs log(j); the asymptotic slope is an estimate of 2H-1.

19 MultiResolution Analysis (1/2) 19 Let {V j, j Z} be a collection of nested subspaces of L 2 (R) such 2 that I V = { 0}, U V is dense in L ( R), V V, j Z j j Z j Morevoer, assume that ft () Vj f( 2 t) V0 and that there exist a so called scaling function ϕ 0 (t) V 0 such that {ϕ 0 (tðn), n Z} be an orthonormal basis in V 0 It follows that ϕ j,k (t)=2 Ðj/2 ϕ 0 (2 Ðj tðk), k Z is an orthonormal basis of V j. For any function f(t) we let j j j 1 approx () t = ( Proj f )() t = a φ () t j Vj jk, jk, k detail () t = approx () t approx () t j j 1 j

20 MultiResolution Analysis (2/2) 20 This corresponds to Vj 1 = Vj Wj, Vj Wj Vj = VJ W The MRA expansion of a discrete variable function gives the Discrete Wavelet Transform (DWT), i.e. the collection of the coarsest scale approximation coefficients and of the detail coefficients of all finer scales ft () Aft () = Aft () + Dft () = a φ () t + d ψ () t 0 J J J j 1 k = 0 j Jk, Jk, jk, jk, j = 1 k j = 1k Important feature: # of vanishing moments of the mother wavelet ψ 0 (t), N J J k

21 Haar DWT 21 + In the Haar DWT the approximation and detail coefficients of a given scale are computed simply as rescaled sums of consecutive approximation coefficients of the finer scale a d jk, jk, = = a a + a j 12, k+ 1 j 12, k 2 a j 12, k+ 1 j 12, k 2 and a a j 12, k+ 1 j 12, k = = a a + d jk, jk, 2 d jk, jk, 2 + For this DWT the smoothness of the mother wavelet is N=1

22 Graphical representation of HDWT 22 j=0 a 0,0 a 0,1 a 0,2 a 0,3 a 0,4 a 0,5 a 0,6 a 0,7 d 1,0 d 1,1 d 1,2 d 1,3 D 1 j=1 a 1,0 a 1,1 a 1,2 a 1,3 d 2,0 d 2,1 D 2 j=2 a 2,0 a 2,1 j=3 d 3,0 a 3,0 D 3 A 3

23 Wavelet and LRD 23 For a wide sense stationary process E d A key property of the details of the DWT of a LRD process with α=2hð1 is It can be shown that [ 2 ] j jk = Γ Φ, X( ν) 2 0( 2 ν) dν [ d ] 2 ~ c ν Φ0( ν) dν j E 2 j( H H j, 2 1 ) f E[ j i H N j i djk, dih, ] 2 k 2 h, 2 k 2 h j 2

24 Wavelet scaling analysis (1/2) 24 The quantity E = d N represents the energy of the details at scale j j 1 2 jk, j k LRD and H can be estimated by constructing the Wavelet scaling plot, i.e. the plot of log 2 (E j ) vs. j (provided the number of vanishing moments of the wavelet is larger than HÐ1) ( ) + log 2 E j ~ const j( 2H 1), j H can be estimated by the slope of the linear part of the wavelet scaling plot

25 Wavelet scaling analysis (2/2) 25 Wavelet Scaling Detail coefficient autocorrelation function 44 1 log 2 (E j ) Slope=2HÐ Scale j= j x 10 4

26 Traffic synthesis via HDWT (1/4) 26 The wavelet based generator requires few input parameters to produce a traffic trace Parsimonious model mean µ, variance σ 2, Hurst parameter H and peak value M Non parsimonious model mean µ, wavelet scaling plot and peak value M It is possible to mimic also non strictly self-similar behaviour (multifractal scaling as generated by random cascades) Traffic is generated by constructing a DWT sequence, then inverting it, so as to obtain a sequence {X k, k =1,É,N } representing the number of bytes per time quantum

27 Traffic synthesis via HDWT (2/4) 27 + The DWT sequence of length N=2 J samples is made up of the coarsest scale approximation, a J,0 the details, d j,k, k=0,é,n/2 j -1, j=j,é,1 + Key observation: by the properties of the DWT of LRD sequence, it can be assumed that the d j,k are zero-mean independent random variables with symmetric distribution + Their variance is found by requiring the LINEAR wavelet scaling and the overall sequence variance: σ 4 1 j( 2H 1) Var( d j, k) = σ 2, j = 1,, J ( 1 H) J j 1 H

28 Traffic synthesis via HDWT (3/4) 28 The mean is imposed by letting a J,0 = ( 2) E[ X ] A key requirement is that the traffic trace be non-negative: this can be imposed directly on the HDWT coefficients d a d = c a, c ~ C [ 11, ] jk, jk, jk, jk, jk, jk, ( j) To impose a peak value it must be J J djk, ( ) M ajk, djk, min ajk,,( ) 2 2 M ajk, The distribution of the details is typically assumed to be the truncated gaussian, the symmetric beta distribution or the uniform with impulses on the border of the interval J

29 Traffic synthesis via HDWT (4/4) 29 The iteration (no peak value requirement) is a a j 12, k j 12, k+ 1 1 c = +, 2 1 c = jk 2 a jk, jk, a jk, j k = 0,, N 2 1; j = J,, 1 An explicit formula can be found for the final traffico trace x(k)=a 0,k J J J C j j = 1 ( ) Xk ( ) = d 2 a, 0 1+ C( )

30 DEC10ms trace 30 Loss probability load = 0.8 Loss probability for real trace Loss probability for synthetic trace (Haar wavelet) Buffer size (byte) Loss probability load = 0.8 Loss probability for real trace Loss probability for synthetic trace (Daub10 wavelet) Buffer size (byte)

31 LBL10ms trace load = load = 0.8 Loss probability Loss probability for real trace Loss probability for synthetic trace (Haar wavelet) Loss probability Loss probability for real trace Loss probability for synthetic trace (Daub10 wavelet) Buffer size (byte) Buffer size (byte)

32 CSELT200ms trace 32 Loss probability 10 0 load = 0.8 Loss probability for real trace Loss probability for synthetic trace (Haar wavelet) Loss probability 10 0 load = 0.8 Loss probability for real trace Loss probability for synthetic trace (Daub10 wavelet) Buffer size (byte) Buffer size (byte)

33 Ethernet10ms trace 33 Loss probability load = 0.8 Loss probability for synthetic trace (Haar wavelet) Loss probability for real trace Loss probability load = 0.8 Loss probability for synthetic trace (Daub10 wavelet) Loss probability for real trace Buffer size (byte) Buffer size (byte)

34 Effect of marginal distribution (2/2) 34 CSELT10ms trace and Haar Wavelet Loss probability load = 0.8 Loss probability for real trace Loss probability for synthetic traces Loss probability Synthetic trace (real marginal) Synthetic trace buffer size = 10 6 bytes Real trace Buffer size (byte) Output capacity load

35 The wavelet model as a cascade (1/2) 35 + For time scale below the typical round trip times the aggregate traffic may depart significantly from the self-similar paradigm, probably due to the reactive congestion control exerted by TCP (routing?) + A multiplicative model: conservative cascade M M M M M M M

36 The wavelet model as a cascade (2/2) 36 Conservative random cascades global scaling: log of the energy of the sequence in level j vs j A random conservative cascade with fixed generator W (=rv with mean 1/2 and belonging to (0,1)) has linear global scaling A random conservative cascade with variable generator λ j W+1/2(1-λ j ) has a non-linear global scaling

37 References 37 [1] W. E. Leland, M. S. Taqqu, W. Willinger, D. Wilson: ÒOn the Self-Similar Nature of Ethernet TrafficÓ, IEEE Transactions on Networking, Vol. 2, No. 1,Febbraio [2] V. Paxson, S. Floyd : ÒWide Area Traffic: The Failure of Poisson ModelingÓ, IEEE/ACM Transactions on Networking, Vol. 3, No. 3, Giugno [3] B. Tsybakov, N. D. Georanas : ÒSelf-Similar Processes in Communications NetworksÓ, IEEE Transactions on Information Theory, Vol. 44, No. 5, Settembre [4] V. Paxson, J. Madhavi, A. Adams, M. Mathis: ÒAn Architecture for Large-Scale Internet MeasurementsÓ, IEEE Communications, Vol. 36, No. 8, Agosto [5] A. Feldmann, A.C. Gilbert, W. Willinger, T.G. Kurtz: "The changing nature of network traffic: scaling phenomena". ACM SIGCOMM Computer Communication Review, Vol. 28, n. 2, April 1998, pp [6] W. Willinger, V. Paxson, M.S. Taqqu : ÒSelf-Similarity and Heavy Tails: Structural Modeling of Network TrafficÓ, in ÒA Practical Guide to heavy tails: statistical techniques and applicationsó, Birkhauser, Boston, [7] R. H. Riedi, M. S. Crouse, V. J. Ribeiro, R. G. Baraniuk : ÒA Multifractal Wavelet Model with Application to Network TrafficÓ, IEEE Transactions on Information Theory, Vol. 45, No. 3, Aprile [8] A.C. Gilbert, W. Willinger : ÒScaling Analysis of Conservative Cascades, with Applications to Network TrafficÓ, IEEE Transactions on Information Theory, Vol. 45, No. 3, Aprile [9] P. Abry, D. Veitch: "Wavelet analysis of long range dependent traffic", IEEE Transactions on Information Theory, Vol. 44, n. 1, January 1998, pp [10] M.E. Crovella, A. Bestavros: "Explaining World Wide Web traffic self similarity", Technical Report TR , Computer Science Dept., Boston Univ., October 1995; also as ACM Sigmetrics, pp , May 1996