Mean-variance relationship of the number of flows in traffic aggregation and its application to traffic management

Ryoichi Kawahara*, Tetsuya Takine, Tatsuya Mori, Noriaki Kamiyama, Keisuke Ishibashi

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

2 Citations (Scopus)


We consider the mean-variance relationship of the number of flows in traffic aggregation, where flows are divided into several groups randomly, based on a predefined flow aggregation index, such as source IP address. We first derive a quadratic relationship between the mean and the variance of the number of flows belonging to a randomly chosen traffic aggregation group. Note here that the result is applicable to sampled flows obtained through packet sampling. We then show that our analytically derived mean-variance relationship fits well those in actual packet trace data sets. Next, we present two applications of the mean-variance relationship to traffic management. One is an application to detecting network anomalies through monitoring a time series of traffic. Using the mean-variance relationship, we determine the traffic aggregation level in traffic monitoring so that it meets two predefined requirements on false positive and false negative ratios simultaneously. The other is an application to load balancing among network equipments that require per-flow management. We utilize the mean-variance relationship for estimating the processing capability required in each network equipment.

Original languageEnglish
Pages (from-to)1560-1576
Number of pages17
JournalComputer Networks
Issue number6
Publication statusPublished - 2013 Apr 22
Externally publishedYes


  • Mean-variance relationship
  • Number of sampled flows
  • Traffic aggregation
  • Traffic measurement

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'Mean-variance relationship of the number of flows in traffic aggregation and its application to traffic management'. Together they form a unique fingerprint.

Cite this