### Abstract

We consider the mean-variance relationship of the number of flows in traffic aggregation, where flows are divided into several groups randomly, based on a predefined flow aggregation index, such as source IP address. We first derive a quadratic relationship between the mean and the variance of the number of flows belonging to a randomly chosen traffic aggregation group. Note here that the result is applicable to sampled flows obtained through packet sampling. We then show that our analytically derived mean-variance relationship fits well those in actual packet trace data sets. Next, we present two applications of the mean-variance relationship to traffic management. One is an application to detecting network anomalies through monitoring a time series of traffic. Using the mean-variance relationship, we determine the traffic aggregation level in traffic monitoring so that it meets two predefined requirements on false positive and false negative ratios simultaneously. The other is an application to load balancing among network equipments that require per-flow management. We utilize the mean-variance relationship for estimating the processing capability required in each network equipment.

Original language | English |
---|---|

Pages (from-to) | 1560-1576 |

Number of pages | 17 |

Journal | Computer Networks |

Volume | 57 |

Issue number | 6 |

DOIs | |

Publication status | Published - 2013 Apr 22 |

Externally published | Yes |

### Fingerprint

### Keywords

- Mean-variance relationship
- Number of sampled flows
- Traffic aggregation
- Traffic measurement

### ASJC Scopus subject areas

- Computer Networks and Communications

### Cite this

*Computer Networks*,

*57*(6), 1560-1576. https://doi.org/10.1016/j.comnet.2013.02.010

**Mean-variance relationship of the number of flows in traffic aggregation and its application to traffic management.** / Kawahara, Ryoichi; Takine, Tetsuya; Mori, Tatsuya; Kamiyama, Noriaki; Ishibashi, Keisuke.

Research output: Contribution to journal › Article

*Computer Networks*, vol. 57, no. 6, pp. 1560-1576. https://doi.org/10.1016/j.comnet.2013.02.010

}

TY - JOUR

T1 - Mean-variance relationship of the number of flows in traffic aggregation and its application to traffic management

AU - Kawahara, Ryoichi

AU - Takine, Tetsuya

AU - Mori, Tatsuya

AU - Kamiyama, Noriaki

AU - Ishibashi, Keisuke

PY - 2013/4/22

Y1 - 2013/4/22

N2 - We consider the mean-variance relationship of the number of flows in traffic aggregation, where flows are divided into several groups randomly, based on a predefined flow aggregation index, such as source IP address. We first derive a quadratic relationship between the mean and the variance of the number of flows belonging to a randomly chosen traffic aggregation group. Note here that the result is applicable to sampled flows obtained through packet sampling. We then show that our analytically derived mean-variance relationship fits well those in actual packet trace data sets. Next, we present two applications of the mean-variance relationship to traffic management. One is an application to detecting network anomalies through monitoring a time series of traffic. Using the mean-variance relationship, we determine the traffic aggregation level in traffic monitoring so that it meets two predefined requirements on false positive and false negative ratios simultaneously. The other is an application to load balancing among network equipments that require per-flow management. We utilize the mean-variance relationship for estimating the processing capability required in each network equipment.

AB - We consider the mean-variance relationship of the number of flows in traffic aggregation, where flows are divided into several groups randomly, based on a predefined flow aggregation index, such as source IP address. We first derive a quadratic relationship between the mean and the variance of the number of flows belonging to a randomly chosen traffic aggregation group. Note here that the result is applicable to sampled flows obtained through packet sampling. We then show that our analytically derived mean-variance relationship fits well those in actual packet trace data sets. Next, we present two applications of the mean-variance relationship to traffic management. One is an application to detecting network anomalies through monitoring a time series of traffic. Using the mean-variance relationship, we determine the traffic aggregation level in traffic monitoring so that it meets two predefined requirements on false positive and false negative ratios simultaneously. The other is an application to load balancing among network equipments that require per-flow management. We utilize the mean-variance relationship for estimating the processing capability required in each network equipment.

KW - Mean-variance relationship

KW - Number of sampled flows

KW - Traffic aggregation

KW - Traffic measurement

UR - http://www.scopus.com/inward/record.url?scp=84876132260&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84876132260&partnerID=8YFLogxK

U2 - 10.1016/j.comnet.2013.02.010

DO - 10.1016/j.comnet.2013.02.010

M3 - Article

AN - SCOPUS:84876132260

VL - 57

SP - 1560

EP - 1576

JO - Computer Networks

JF - Computer Networks

SN - 1389-1286

IS - 6

ER -