An HMM Approach to Internet Traffic Modeling

Traffic modeling is a fertile research area. This paper proposes a packet-level traffic model of traffic sources based on Hidden Markov Model. It has been developed by using real network traffic and estimating in a combined fashion Packet Size and Inter Packet Time. The effectiveness of the proposed model is evaluated by studying several traffic types with strong differences in terms of both applications/users and protocol behavior. Indeed, we applied our model to real traffic traces of Age of Mythology (a Multi Player Network Game), SMTP, and HTTP. An analytical basis and the mathematical details regarding the model are given. Results show how the proposed model captures first-order statistics, as well as temporal dynamics via auto- and cross-correlation. Also, the capability to accurately replicate the considered traffic sources is shown. Finally, preliminary results for model-based traffic prediction reveal encouraging. I. INTRODUCTION Internet traffic modeling is an important and essential task to understand and solve performance-related issues of current and future networks. Many efforts have been focused on modeling of source traffic related to specific application-level protocols, also with the purpose to conduct realistic network traffic simulations and emulations (i.e. generating synthetic traffic in real networks). Although it has been often overlooked by the networking community, packet-level analysis offers very interesting insights (1) (2) (3). Packet-level traffic models express traffic flows in terms of Inter Packet Time (IPT) and Packet Size (PS), basing the analysis on few simple variables, but related to the lowest/deepest point of view. Network devices (Routers, Switches, Access Points) often operate on a packet-by-packet basis (i.e. buffer management), and network problems (Loss, Delay, Jitter) happen at packet level. Other advantages of studying traffic by observing IPT and PS are the avoidance of any assumption regarding the application layer protocol characteristics, and the possibility to study, in the same manner, different kind of sources and even mixes of them.

[1]  Charles V. Wright,et al.  HMM profiles for network traffic classification , 2004, VizSEC/DMSEC '04.

[2]  Deborah Estrin,et al.  An Empirical Workload Model for Driving Wide-Area TCP/IP Network Simulations , 2001 .

[3]  Grenville Armitage,et al.  A synthetic traffic model for Half-Life , 2003 .

[4]  Lorenzo Favalli,et al.  Modeling and analysis of aggregate and single stream Internet traffic , 2003, GLOBECOM '03. IEEE Global Telecommunications Conference (IEEE Cat. No.03CH37489).

[5]  Chabane Djeraba,et al.  A Markovian Approach for Web User Profiling and Clustering , 2003, PAKDD.

[6]  Antonio Pescapè,et al.  A packet-level characterization of network traffic , 2006, 2006 11th International Workshop on Computer-Aided Modeling, Analysis and Design of Communication Links and Networks.

[7]  Mark Claypool,et al.  The effect of latency on user performance in Real-Time Strategy games , 2005, Comput. Networks.

[8]  Lawrence R. Rabiner,et al.  A tutorial on hidden Markov models and selected applications in speech recognition , 1989, Proc. IEEE.

[9]  Peter B. Danzig,et al.  Characteristics of wide-area TCP/IP conversations , 1991, SIGCOMM 1991.

[10]  Marco Ajmone Marsan,et al.  Markov models of internet traffic and a new hierarchical MMPP model , 2005, Comput. Commun..

[11]  Antonio Pescapè,et al.  End-to-end packet-channel Bayesian model applied to heterogeneous wireless networks , 2005, GLOBECOM '05. IEEE Global Telecommunications Conference, 2005..

[12]  Wu-chi Feng,et al.  A traffic characterization of popular on-line games , 2005, IEEE/ACM Transactions on Networking.

[13]  António Pacheco,et al.  Modeling IP traffic: joint characterization of packet arrivals and packet sizes using BMAPs , 2004, Comput. Networks.

[14]  Christoph Lindemann,et al.  Modeling IP traffic using the batch Markovian arrival process , 2003, Perform. Evaluation.

[15]  K. Claffy,et al.  Trends in wide area IP traffic patterns - A view from Ames Internet Exchange , 2000 .