Inferring original traffic pattern from sampled flow statistics

Tatsuya Mori, Ryoich Kawahara, Noriaki Kamiyama, Shigeaki Harada

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.

Original languageEnglish
Title of host publication2007 International Symposium on Applications and the Internet - Workshops, SAINT-W
DOIs
Publication statusPublished - 2007 Dec 1
Externally publishedYes
Event2007 International Symposium on Applications and the Internet - Workshops, SAINT-W - Hiroshima, Japan
Duration: 2007 Jan 152007 Jan 19

Publication series

NameSAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W

Conference

Conference2007 International Symposium on Applications and the Internet - Workshops, SAINT-W
CountryJapan
CityHiroshima
Period07/1/1507/1/19

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Computer Science Applications
  • Software

Fingerprint Dive into the research topics of 'Inferring original traffic pattern from sampled flow statistics'. Together they form a unique fingerprint.

  • Cite this

    Mori, T., Kawahara, R., Kamiyama, N., & Harada, S. (2007). Inferring original traffic pattern from sampled flow statistics. In 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W [4090156] (SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W). https://doi.org/10.1109/SAINT-W.2007.51