Inferring original traffic pattern from sampled flow statistics

Tatsuya Mori, Ryoich Kawahara, Noriaki Kamiyama, Shigeaki Harada

研究成果: Conference contribution

2 引用 (Scopus)

抄録

Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.

元の言語English
ホスト出版物のタイトルSAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W
DOI
出版物ステータスPublished - 2007
外部発表Yes
イベント2007 International Symposium on Applications and the Internet - Workshops, SAINT-W - Hiroshima
継続期間: 2007 1 152007 1 19

Other

Other2007 International Symposium on Applications and the Internet - Workshops, SAINT-W
Hiroshima
期間07/1/1507/1/19

Fingerprint

Statistics
Sampling

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Computer Science Applications
  • Software

これを引用

Mori, T., Kawahara, R., Kamiyama, N., & Harada, S. (2007). Inferring original traffic pattern from sampled flow statistics. : SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W [4090156] https://doi.org/10.1109/SAINT-W.2007.51

Inferring original traffic pattern from sampled flow statistics. / Mori, Tatsuya; Kawahara, Ryoich; Kamiyama, Noriaki; Harada, Shigeaki.

SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W. 2007. 4090156.

研究成果: Conference contribution

Mori, T, Kawahara, R, Kamiyama, N & Harada, S 2007, Inferring original traffic pattern from sampled flow statistics. : SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W., 4090156, 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W, Hiroshima, 07/1/15. https://doi.org/10.1109/SAINT-W.2007.51
Mori T, Kawahara R, Kamiyama N, Harada S. Inferring original traffic pattern from sampled flow statistics. : SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W. 2007. 4090156 https://doi.org/10.1109/SAINT-W.2007.51
Mori, Tatsuya ; Kawahara, Ryoich ; Kamiyama, Noriaki ; Harada, Shigeaki. / Inferring original traffic pattern from sampled flow statistics. SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W. 2007.
@inproceedings{da321494d0e148d1b613a9c9dc83825a,
title = "Inferring original traffic pattern from sampled flow statistics",
abstract = "Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.",
author = "Tatsuya Mori and Ryoich Kawahara and Noriaki Kamiyama and Shigeaki Harada",
year = "2007",
doi = "10.1109/SAINT-W.2007.51",
language = "English",
isbn = "0769527574",
booktitle = "SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W",

}

TY - GEN

T1 - Inferring original traffic pattern from sampled flow statistics

AU - Mori, Tatsuya

AU - Kawahara, Ryoich

AU - Kamiyama, Noriaki

AU - Harada, Shigeaki

PY - 2007

Y1 - 2007

N2 - Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.

AB - Packet sampling has become a practical and indispensable means to measure flow statistics. Recent studies have demonstrated that analyzing traffic patterns is crucial in detecting network anomalies. We may not be able to infer the original traffic patterns correctly from the sampled flow statistics because sampling process wipes out a lot of information about small flows, which play a vital role in determining the characteristics of traffic patterns. In this paper, we first show an example of how the sampling process wipes out the original statistics using measured data. Then, we show empirical examples indicating that the original traffic pattern cannot be inferred correctly even if we use a statistical inference method for incomplete data, i.e., the EM algorithm, for sampled flow statistics. Finally, we show that additional information about the original flow statistics, the number of unsampled flows, is helpful in tracking the change in original traffic patterns using sampled flow statistics.

UR - http://www.scopus.com/inward/record.url?scp=46349099953&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=46349099953&partnerID=8YFLogxK

U2 - 10.1109/SAINT-W.2007.51

DO - 10.1109/SAINT-W.2007.51

M3 - Conference contribution

AN - SCOPUS:46349099953

SN - 0769527574

SN - 9780769527574

BT - SAINT - 2007 International Symposium on Applications and the Internet - Workshops, SAINT-W

ER -