SPSD: An alternative attribute for a flow using packet sampling

Packet size distribution (PSD), known as the probability distribution of packet size in a flow, is an important attribute for traffic analysis. However, to get a flow's precise PSD is computationally intensive due to the massive flows in networks and massive packets in some flows. In this paper, we propose an alternative attribute, sampled packet size distribution (SPSD), which can give a proper estimation of PSD. We introduce a bi-directional flow model and the probability representation of SPSD. Generating method of SPSD is also given, where SPSD is collected from a sampled trace, which makes it easier to get and have a great reduction in the number of packets being processed. Based on a real trace collected from the campus network, we confirm that SPSD varies slightly from PSD on low sampling granularity. The cosine and KL distances between SPSD and PSD of a flow are less than 10-2 and 10-1 respectively. Also, the orderliness of PSD distance sequence is well preserved when SPSD used.

[1]  Nicolas Hohn,et al.  Inverting sampled traffic , 2003, IMC '03.

[2]  Judith Kelner,et al.  A Survey on Internet Traffic Identification , 2009, IEEE Communications Surveys & Tutorials.

[3]  kc claffy,et al.  Application of sampling methodologies to network traffic characterization , 1993, SIGCOMM 1993.

[4]  Grenville J. Armitage,et al.  A survey of techniques for internet traffic classification using machine learning , 2008, IEEE Communications Surveys & Tutorials.

[5]  Nick Duffield,et al.  Sampling for Passive Internet Measurement: A Review , 2004 .

[6]  Chun-Ying Huang,et al.  Session level flow classification by packet size distribution and session grouping , 2012, Comput. Networks.

[7]  Carsten Lund,et al.  Estimating flow distributions from sampled flow statistics , 2003, SIGCOMM '03.

[8]  George Varghese,et al.  New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice , 2003, TOCS.

[9]  Fang Liu,et al.  The packet size distribution patterns of the typical Internet applications , 2012, 2012 3rd IEEE International Conference on Network Infrastructure and Digital Content.

[10]  Shunji Abe,et al.  Detecting DoS attacks using packet size distribution , 2007, 2007 2nd Bio-Inspired Models of Network, Information and Computing Systems.