Inferring original traffic pattern from sampled flow statistics

Tatsuya Mori, Ryoich Kawahara, Noriaki Kamiyama, Shigeaki Harada

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.

Original languageEnglish
Title of host publicationSAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W
DOIs
Publication statusPublished - 2007
Externally publishedYes
Event2007 International Symposium on Applications and the Internet - Workshops, SAINT-W - Hiroshima
Duration: 2007 Jan 152007 Jan 19

Other

Other2007 International Symposium on Applications and the Internet - Workshops, SAINT-W
CityHiroshima
Period07/1/1507/1/19

Fingerprint

Statistics
Sampling

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Computer Science Applications
  • Software

Cite this

Mori, T., Kawahara, R., Kamiyama, N., & Harada, S. (2007). Inferring original traffic pattern from sampled flow statistics. In SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W [4090156] https://doi.org/10.1109/SAINT-W.2007.51

Inferring original traffic pattern from sampled flow statistics. / Mori, Tatsuya; Kawahara, Ryoich; Kamiyama, Noriaki; Harada, Shigeaki.

SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W. 2007. 4090156.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Mori, T, Kawahara, R, Kamiyama, N & Harada, S 2007, Inferring original traffic pattern from sampled flow statistics. in SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W., 4090156, 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W, Hiroshima, 07/1/15. https://doi.org/10.1109/SAINT-W.2007.51
Mori T, Kawahara R, Kamiyama N, Harada S. Inferring original traffic pattern from sampled flow statistics. In SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W. 2007. 4090156 https://doi.org/10.1109/SAINT-W.2007.51
Mori, Tatsuya ; Kawahara, Ryoich ; Kamiyama, Noriaki ; Harada, Shigeaki. / Inferring original traffic pattern from sampled flow statistics. SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W. 2007.
@inproceedings{da321494d0e148d1b613a9c9dc83825a,
title = "Inferring original traffic pattern from sampled flow statistics",
abstract = "Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.",
author = "Tatsuya Mori and Ryoich Kawahara and Noriaki Kamiyama and Shigeaki Harada",
year = "2007",
doi = "10.1109/SAINT-W.2007.51",
language = "English",
isbn = "0769527574",
booktitle = "SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W",

}

TY - GEN

T1 - Inferring original traffic pattern from sampled flow statistics

AU - Mori, Tatsuya

AU - Kawahara, Ryoich

AU - Kamiyama, Noriaki

AU - Harada, Shigeaki

PY - 2007

Y1 - 2007

N2 - Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.

AB - Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.

UR - http://www.scopus.com/inward/record.url?scp=46349099953&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=46349099953&partnerID=8YFLogxK

U2 - 10.1109/SAINT-W.2007.51

DO - 10.1109/SAINT-W.2007.51

M3 - Conference contribution

SN - 0769527574

SN - 9780769527574

BT - SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W

ER -