Internet traffic modeling by means of Hidden Markov Models

In this work, we propose a Hidden Markov Model for Internet traffic sources at packet level, jointly analyzing Inter Packet Time and Packet Size. We give an analytical basis and the mathematical details regarding the model, and we test the flexibility of the proposed modeling approach with real traffic traces related to common Internet services with strong differences in terms of both applications/users and protocol behavior: SMTP, HTTP, a network game, and an instant messaging platform. The presented experimental analysis shows that, even maintaining a simple structure, the model is able to achieve good results in terms of estimation of statistical parameters and synthetic series generation, taking into account marginal distributions, mutual, and temporal dependencies. Moreover we show how, by exploiting such temporal dependencies, the model is able to perform short-term prediction by observing traffic from real sources.

[1]  Erich M. Nahum,et al.  A study of Internet instant messaging and chat protocols , 2006, IEEE Network.

[2]  Louis A. Liporace,et al.  Maximum likelihood estimation for multivariate observations of Markov sources , 1982, IEEE Trans. Inf. Theory.

[3]  Deborah Estrin,et al.  An Empirical Workload Model for Driving Wide-Area TCP/IP Network Simulations , 2001 .

[4]  Grenville Armitage,et al.  A synthetic traffic model for Half-Life , 2003 .

[5]  Alberto Dainotti,et al.  A packet-level traffic model of Starcraft , 2005 .

[6]  Steven McCanne,et al.  The BSD Packet Filter: A New Architecture for User-level Packet Capture , 1993, USENIX Winter.

[7]  Lawrence R. Rabiner,et al.  A tutorial on hidden Markov models and selected applications in speech recognition , 1989, Proc. IEEE.

[8]  Kevin Jeffay,et al.  What TCP/IP protocol headers can tell us about the web , 2001, SIGMETRICS '01.

[9]  Zhen Xiao,et al.  Understanding Instant Messaging Traffic Characteristics , 2007, 27th International Conference on Distributed Computing Systems (ICDCS '07).

[10]  Donald F. Towsley,et al.  Continuous-time hidden Markov models for network performance evaluation , 2002, Perform. Evaluation.

[11]  L. Breuer.  Introduction to Stochastic Processes , 2022, Statistical Methods for Climate Scientists.

[12]  Marco Ajmone Marsan,et al.  Markov models of internet traffic and a new hierarchical MMPP model , 2005, Comput. Commun..

[13]  Jianbo Gao,et al.  Multifractal analysis and modeling of long-range-dependent traffic , 1999, 1999 IEEE International Conference on Communications (Cat. No. 99CH36311).

[14]  Antonio Pescapè,et al.  Searching for invariants in network games traffic , 2006, CoNEXT '06.

[15]  Eryk Dutkiewicz,et al.  Modelling multi-player games traffic , 2000, Proceedings International Conference on Information Technology: Coding and Computing (Cat. No.PR00540).

[16]  Bo Friis Nielsen,et al.  A Markovian approach for modeling packet traffic with long-range dependence , 1998, IEEE J. Sel. Areas Commun..

[17]  Biing-Hwang Juang,et al.  Maximum likelihood estimation for multivariate mixture observations of markov chains , 1986, IEEE Trans. Inf. Theory.

[18]  Kavé Salamatian,et al.  Hidden Markov modeling for network communication channels , 2001, SIGMETRICS '01.

[19]  Bruce A. Mah,et al.  An empirical model of HTTP network traffic , 1997, Proceedings of INFOCOM '97.

[20]  António Pacheco,et al.  Modeling IP traffic: joint characterization of packet arrivals and packet sizes using BMAPs , 2004, Comput. Networks.

[21]  Michael S. Borella,et al.  Source models of network game traffic , 2000, Comput. Commun..

[22]  Michalis Faloutsos,et al.  Transport layer identification of P2P traffic , 2004, IMC '04.

[23]  Mark Claypool,et al.  The effect of latency on user performance in Real-Time Strategy games , 2005, Comput. Networks.

[24]  M. E. Johnson,et al.  Estimating model discrepancy , 1990 .

[25]  Francesco Palmieri,et al.  Joint end-to-end loss-delay hidden Markov model for periodic UDP traffic over the Internet , 2006, IEEE Transactions on Signal Processing.

[26]  Rahul Ohri.  Measurement-Based E-Mail Traffic Characterization , 2005 .

[27]  Lorenzo Favalli,et al.  Modeling and analysis of aggregate and single stream Internet traffic , 2003, GLOBECOM '03. IEEE Global Telecommunications Conference (IEEE Cat. No.03CH37489).

[28]  Oliver Rose,et al.  Simple and Efficient Models for Variable Bit Rate MPEG Video Traffic , 1997, Perform. Evaluation.

[29]  Jin Cao,et al.  Stochastic models for generating synthetic HTTP source traffic , 2004, IEEE INFOCOM 2004.

[30]  Wu-chi Feng,et al.  A traffic characterization of popular on-line games , 2005, IEEE/ACM Transactions on Networking.

[31]  Antonio Pescapè,et al.  A packet-level characterization of network traffic , 2006, 2006 11th International Workshop on Computer-Aided Modeling, Analysis and Design of Communication Links and Networks.

[32]  Peter B. Danzig,et al.  Characteristics of wide-area TCP/IP conversations , 1991, SIGCOMM '91.

[33]  Charles V. Wright,et al.  HMM profiles for network traffic classification , 2004, VizSEC/DMSEC '04.

[34]  Antonio Pescapè,et al.  QRP07-2: An HMM Approach to Internet Traffic Modeling , 2006, IEEE Globecom 2006.

[35]  Johannes Färber,et al.  Network game traffic modelling , 2002, NetGames '02.

[36]  Antonio Pescapè,et al.  End-to-end packet-channel Bayesian model applied to heterogeneous wireless networks , 2005, GLOBECOM '05. IEEE Global Telecommunications Conference, 2005..

[37]  Alberto Dainotti,et al.  An HMM Approach to Internet Traffic Modeling , 2006 .

[38]  Jeff A. Bilmes,et al.  A gentle tutorial of the em algorithm and its application to parameter estimation for Gaussian mixture and hidden Markov models , 1998 .

[39]  Christoph Lindemann,et al.  Modeling IP traffic using the batch Markovian arrival process , 2003, Perform. Evaluation.

[40]  K. Claffy,et al.  Trends in wide area IP traffic patterns - A view from Ames Internet Exchange , 2000 .