The efficiency of flow-based networking mechanisms strongly depends on traffic characteristics and should thus be assessed using accurate flow models. For example, in the case of algorithms based on the distinction between elephant and mice flows, it is extremely important to ensure realistic flows' length and size distributions. Credible models or data are not available in literature. Numerous works contain only plots roughly presenting empirical distribution of selected flow parameters, without providing distribution mixture models or any reusable numerical data. This paper aims to fill that gap and provide reusable models of flow length and size derived from real traffic traces. Traces were collected at the Internet-facing interface of the university campus network and comprise four billion layer-4 flow (275 TB). These models can be used to assess a variety of flow-oriented solutions under the assumption of realistic conditions. Additionally, this paper provides a tutorial on constructing network flow models from traffic traces. The proposed methodology is universal and can be applied to traffic traces gathered in any network. We also provide an open source software framework to analyze flow traces and fit general mixture models to them.
Information-Centric Networking (ICN) specifically Name Data Networking (NDN) is the name-base (content-base) networking and takes named-contents as "first class citizen", being considered as the ideal candidate to form the Future Internet basis. NDN striking features like named-data self-secured contents, name-base-forwarding, in-network caching and mobility support suits the Internet of Things (IoT) environment, which aims to enable communication among smart devices and to combine all Internet-based smart applications under the one roof. With these aims, IoT put many research challenges regar…
Till now the academic institutes in Kurdistan region not connected via network with each other and with research centers worldwide, this paper suggests design an optical IP-Network for academic Kurdistan region based on DWDM (Dense wavelength Division Multiplexer) backbone. The design has been developed using minimum spanning tree between the main realistic locations for campuses in each province were calculated using Prim's algorithm in province level. This proposed network simulated using OPENT IT GURU, and then information was collected using GPS and GIS about the campuses (to obtain realis…
Wireless Local Area Networks (WLANs), known as Wi-Fi, have become an essential service in university environments that helps staff, students and guests to access connectivity to the Internet from their mobile devices. Apart from the Internet being a learning resource, students also submit their assignments online using web portals. Most campuses will have poor coverage areas for mobile networks and, as a result, the ability of the wireless network to supplement Internet access for mobile devices in these areas becomes more important. Acquiring clear understanding of WLAN traffic patterns, netw…
Energy efficiency solutions are more vital for Green Mesh Network (GMN) campuses. Today students are benefited using these e-learning methodologies. Renewable energies such as solar, wind, hydro has tremendous applications on energy efficient wireless networks for sustaining the ever growing traffic demands. One of the major issues in designing a GMN is minimizing the number of deployed mesh routers and gateways and satisfying the sustainable QOS based energy constraints. During low traffic periods the mesh routers are switched to power save or sleep mode. In this paper we have mathematically …
The COVID-19 pandemic led to the adoption of severe measures to counteract the spread of the infection. Social distancing and lockdown measures modifies people's habits, while the Internet gains a major role to support remote working, e-teaching, online collaboration, gaming, video streaming, etc. All these sudden changes put unprecedented stress on the network. In this paper we analyze the impact of the lockdown enforcement on the Politecnico di Torino campus network. Right after the school shutdown on the 25th of February, PoliTO deployed its own in-house solution for virtual teaching. Ever …
Internet traffic displays many persistent periodicities (oscillations) on a large range of time scales. This paper describes the measurement methodology to detect Internet traffic periodicities and also describes the main periodicities in Internet traffic.
Introducing Internet traffic anomaly detection mechanism based on large deviations results for empirical measures. Using past traffic traces we characterize network traffic during various time-of-day intervals, assuming that it is anomaly-free. Throughout, we compare the two approaches presenting their advantages and disadvantages to identify and classify temporal network anomalies. We also demonstrate how our framework can be used to monitor traffic from multiple network elements in order to identify both spatial and temporal anomalies. We validate our techniques by analyzing real traffic tra…
Modeling Internet growth is important both for understanding the current network and to predict and improve its future. To date, Internet models have typically attempted to explain a subset of the following characteristics: network structure, traffic flow, geography, and economy. In this paper we present a discrete, agent-based model, that integrates all of them. We show that the model generates networks with topologies, dynamics, and (more speculatively) spatial distributions that are similar to the Internet.
Mobile network traffic prediction is an important input in to network capacity planning and optimization. Existing approaches may lack the speed and computational complexity to account for bursting, non-linear patterns or other important correlations in time series mobile network data. We compare the performance of two deep learning architectures - Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) - for predicting mobile Internet traffic using two months of Telecom Italia data for the metropolitan area of Milan. K-Means clustering was used a priori to group cells based on Internet a…
We present a simple model reproducing the long-range autocorrelations and the power spectrum of the web traffic. The model assumes the traffic as Poisson flow of files with size distributed according to the power-law. In this model the long-range autocorrelations are independent of the network properties as well as of inter-packet time distribution.
Internet of Things (IoT) defines a network of devices connected to the internet and sharing a massive amount of data between each other and a central location. These IoT devices are connected to a network therefore prone to attacks. Various management tasks and network operations such as security, intrusion detection, Quality-of-Service provisioning, performance monitoring, resource provisioning, and traffic engineering require traffic classification. Due to the ineffectiveness of traditional classification schemes, such as port-based and payload-based methods, researchers proposed machine lea…
Transport protocols use port numbers to allow connection multiplexing on Internet hosts. TCP as well as UDP, the two most widely used transport protocols, have limitations on what constitutes a valid and invalid port number. One example of an invalid port number for these protocols is port 0. In this work, we present preliminary results from analyzing port 0 traffic at a large European IXP. In one week of traffic we find 74GB port 0 traffic. The vast majority of this traffic has both source and destination ports set to 0, suggesting scanning or reconnaissance as its root cause. Our analysis al…
Trust management of Internet of connected vehicles has been a hot topic during the recent years with the rapid development of UGV technologies. However, existing resolutions based on trustworthiness verification among vehicles make the traffic event transmission quite inefficient. In this paper, we assume that the deployed RSUs can provide efficient communication between any pair of RSU and vehicle, and propose Vcash, a reputation framework for identifying denial of traffic service, to resolve the trustworthiness problem in the application level of the Internet of connected vehicles. In our re…
Link dimensioning is used by ISPs to properly provision the capacity of their network links. Operators have to make provisions for sudden traffic bursts and network failures to assure uninterrupted operations. In practice, traffic averages are used to roughly estimate required capacity. More accurate solutions often require traffic statistics easily obtained from packet captures, e.g. variance. Our investigations on real Internet traffic have emphasized that the traffic shows high variations at small aggregation times, which indicates that the traffic is self-similar and has a heavy-tailed cha…
Denial of Service (DoS) attacks are one of the most challenging threats to Internet security. An attacker typically compromises a large number of vulnerable hosts and uses them to flood the victim's site with malicious traffic, clogging its tail circuit and interfering with normal traffic. At present, the network operator of a site under attack has no other resolution but to respond manually by inserting filters in the appropriate edge routers to drop attack traffic. However, as DoS attacks become increasingly sophisticated, manual filter propagation becomes unacceptably slow or even infeasibl…
The Internet traffic matrix plays a significant roll in network operation and management, therefore, the structural analysis of traffic matrix, which decomposes different traffic components of this high-dimensional traffic dataset, is quite valuable to some network applications. In this study, based on the Robust Principal Component Analysis (RPCA) theory, a novel traffic matrix structural analysis approach named Multi-Resolution RPCA is created, which utilizes the wavelet multi-resolution analysis. Firstly, we build the Multi-Resolution Traffic Matrix Decomposition Model (MR-TMDM), which char…
A new method of estimating some statistical characteristics of TCP flows in the Internet is developed in this paper. For this purpose, a new set of random variables (referred to as observables) is defined. When dealing with sampled traffic, these observables can easily be computed from sampled data. By adopting a convenient mouse/elephant dichotomy also dependent on traffic, it is shown how these variables give a reliable statistical representation of the number of packets transmitted by large flows during successive time intervals with an appropriate duration. A mathematical framework is deve…
We propose flow-based analysis to estimate quality of an Internet connection. Using results from the queuing theory we compare two expressions for backbone traffic that have different scopes of applicability. A curve that shows dependence of utilization of a link on a number of active flows in it describes different states of the network. We propose a methodology for plotting such a curve using data received from a Cisco router by NetFlow protocol, determining the working area and the overloading point of the network. Our test is an easy way to find a moment for upgrading the backbone.
The rapid deployment of new Internet protocols over the last few years and the COVID-19 pandemic more recently (2020) has resulted in a change in the Internet traffic composition. Consequently, an updated microscopic view of traffic shares is needed to understand how the Internet is evolving to capture both such shorter- and longer-term events. Toward this end, we observe traffic composition at a research network in Japan and a Tier-1 ISP in the USA. We analyze the traffic traces passively captured at two inter-domain links: MAWI (Japan) and CAIDA (New York-Sao Paulo), which cover 100GB of dat…
Asynchronous transfer mode (ATM) is the new generation of computer and communication networks that are being deployed throughout the telecommunication industry as well as in campus backbones. ATM technology distinguishes itself from the previous networking protocols in that it has the latest traffic management technology and thus allows guaranteeing delay, throughput, and other performance measures. This in turn, allows users to integrate voice, video, and data on the same network. Available bit rate (ABR) service in ATM has been designed to fairly distribute all unused capacity to data traffi…
We advocate to create a \emph{spot} Internet transit market, where transit is sold using the under-utilized backbone capacity at a lower price. The providers can improve profit by capitalizing the perishable capacity, and customers can buy transit on-demand without a minimum commitment level for elastic traffic, and as a result improve its surplus (i.e. utility gains). We conduct a systematic study of the economical benefits of spot transit both theoretically and empirically. We propose a simple analytical framework with a general demand function, and solve the pricing problem of maximizing th…
The emergence of video applications and video capable devices have contributed substantially to the increase of video traffic on Internet. New mechanisms recommending video rate adaptation towards delivering enhanced Quality of Experience (QoE) at the same time making room for more sessions. This paper introduces a cross-layer QoE-aware architecture for video traffic over the Internet. It proposes that video sources at the application layer adapt their rate to the network environment by controlling their transmitted bit rate dynamically; and the edge of network at the network layer protects th…
In the mid-90's, it was shown that the statistics of aggregated time series from Internet traffic departed from those of traditional short range dependent models, and were instead characterized by asymptotic self-similarity. Following this seminal contribution, over the years, many studies have investigated the existence and form of scaling in Internet traffic. This contribution aims first at presenting a methodology, combining multiscale analysis (wavelet and wavelet leaders) and random projections (or sketches), permitting a precise, efficient and robust characterization of scaling which is …
An extensive body of research deals with estimating the correlation and the Hurst parameter of Internet traffic traces. The significance of these statistics is due to their fundamental impact on network performance. The coverage of Internet traffic traces is, however, limited since acquiring such traces is challenging with respect to, e.g., confidentiality, logging speed, and storage capacity. In this work, we investigate how the correlation of Internet traffic can be reliably estimated from random traffic samples. These samples are observed either by passive monitoring within the network, or …
With the widespread adoption of Internet of Things (IoT), billions of everyday objects are being connected to the Internet. Effective management of these devices to support reliable, secure and high quality applications becomes challenging due to the scale. As one of the key cornerstones of IoT device management, automatic cross-device classification aims to identify the semantic type of a device by analyzing its network traffic. It has the potential to underpin a broad range of novel features such as enhanced security (by imposing the appropriate rules for constraining the communications of c…
This paper introduces Nimbus, a robust technique to detect whether the cross traffic competing with a flow is "elastic", and shows that this elasticity detector improves congestion control. If cross traffic is inelastic, then a sender can control queueing delays while achieving high throughput, but in the presence of elastic traffic, it may lose throughput if it attempts to control packet delay. To estimate elasticity, Nimbus modulates the flow's sending rate with sinusoidal pulses that create small traffic fluctuations at the bottleneck link, and measures the frequency response of the rate of…
Getting good statistical models of traffic on network links is a well-known, often-studied problem. A lot of attention has been given to correlation patterns and flow duration. The distribution of the amount of traffic per unit time is an equally important but less studied problem. We study a large number of traffic traces from many different networks including academic, commercial and residential networks using state-of-the-art statistical techniques. We show that the log-normal distribution is a better fit than the Gaussian distribution commonly claimed in the literature. We also investigate…
Internet Service Providers (ISPs) are increasingly offering content-based packages to their clients. These packages offer access to a range of online content, such as Facebook, YouTube, Messenger, Zoom, and many other popular services, for a fixed price. This allows users to access all the content they want without worrying about data caps or overage charges. These packages are way cheaper than regular internet packages. Even some ISPs offer unlimited content-based packages for a low price. When using these packages, network traffic is continuously filtered by the ISP, and the user will be cha…
Queues allow network operators to control traffic: where queues build, they can enforce scheduling and shaping policies. In the Internet today, however, there is a mismatch between where queues build and where control is most effectively enforced; queues build at bottleneck links that are often not under the control of the data sender. To resolve this mismatch, we propose a new kind of middlebox, called Bundler. Bundler uses a novel inner control loop between a sendbox (in the sender's site) and a receivebox (in the receiver's site) to determine the aggregate rate for the bundle, leaving the e…
The different level of interest in deploying the new Internet address space across network operators has kept IPv6 tardy in its deployment. However, since the last block of IPv4 addresses has been assigned, Internet communities took the concern of the address space scarcity seriously and started to move forward actively. After the successful IPv6 test on 8 June, 2011 (World IPv6 Day [1]), network operators and service/content providers were brought together for preparing the next step of the IPv6 global deployment (World IPv6 Launch on 6 June, 2012 [2]). The main purpose of the event was to pe…
The performance of networks that use the Internet Protocol is sensitive to precise configuration of many low-level parameters on each network device. These settings govern the action of dynamic routing protocols, which direct the flow of traffic; in order to ensure that these dynamic protocols all converge to produce some 'optimal' flow, each parameter must be set correctly. Multiple conflicting optimization objectives, nondeterminism, and the need to reason about different failure scenarios make the task particularly complicated. We present a fast and flexible approach for the analysis of a n…
In recent years, there are some major changes in the way content is being distributed over the network. The content distribution techniques have recently started to embrace peer-to-peer (P2P) systems as an alternative to the traditional client-server architecture. P2P systemsthat are based on the BitTorrent protocol uses end-users' resources to provide a cost effective distribution of bandwidth intensive content to thousands of users. The BitTorrent protocol system offers a scalable mechanism for distributing a large volume of data to a set of peers over the Internet. With the growing demand f…
The raising level of traffic imposes a great demand in the growth of intelligent traffic systems. With increase in complexity of alleviation, finding solutions to traffic congestion problem have become one of the challenges. Various optimization techniques have been proposed in literature to meet these challenges. This paper surveys different optimization techniques based on heuristics for automated traffic congestion control. Moreover, an approach based on River Formation Dynamics scheme is introduced to analyze the optimization problem for traffic congestion control and a scheme to extract r…
Domain name system communication may provide sensitive information on users' Internet activity. DNS-over-TLS and DNS-over-HTTPS are proposals aiming at increasing the privacy of Internet end users. In this paper we present an overview of the current state in the deployment of DNS-over-HTTPS (DoH) implementations complemented by measurements of DoH traffic in terms of the incurred overhead and the possibility of the DoH detection based on the inherent characteristics of the communication patterns.
The first decade of the 21st century has seen tremendous improvements in mobile internet and its technologies. The high traffic volume of services such as video conference and other real-time traffic applications are imposing a great challenge on networks. In the meantime, demand for the use of mobile devices in computation and communication such as smart phones, personal digital assistants, and mobile-enabled laptops has grown rapidly. These services have driven the demand for increasing and guaranteing bandwidth requirements in the network. A direction of this paper is in the case of resourc…
The lack of security of the Internet routing protocol (BGP) has allowed attackers to divert Internet traffic and consequently perpetrate service disruptions, monetary frauds, and even citizen surveillance for decades. State-of-the-art defenses rely on geo-distributed BGP monitors to detect rogue BGP announcements. As we show, though, attackers can easily evade detection by engineering their announcements. This paper presents Oscilloscope, an approach to accurately detect BGP hijacks by relying on real-time traffic analysis. As hijacks inevitably change the characteristics of the diverted traff…
Industrial control systems (ICS) are managed remotely with the help of dedicated protocols that were originally designed to work in walled gardens. Many of these protocols have been adapted to Internet transport and support wide-area communication. ICS now exchange insecure traffic on an inter-domain level, putting at risk not only common critical infrastructure but also the Internet ecosystem (e.g., DRDoS~attacks). In this paper, we uncover unprotected inter-domain ICS traffic at two central Internet vantage points, an IXP and an ISP. This traffic analysis is correlated with data from honeypo…
Nowadays, Machine-to-Machine (M2M) and Internet of Things (IoT) traffic rate is increasing at a fast pace. The use of satellites is expected to play a large role in delivering such a traffic. In this work, we investigate the use of two of the most common M2M/IoT protocols stacks on a satellite Random Access (RA) channel, based on DVB-RCS2 standard. The metric under consideration is the completion time, in order to identify the protocol stack that can provide the best performance level.
With the increasing usage of mobile devices to ubiquitously access heterogeneous applications in wireless Internet, the measurement and analysis of Internet traffic has become a key research area. In this paper, we present the results of our measurements for VBR traffic over UDP in 802.11g and GPRS networks. We focus on Inter-Packet Arrival Time (IPRT) and Inter-Packet Transmission Delay (IPTD) and observe that the later has a significant impact on the round trip delay. Numerical parameters for Weibull, Exponential and Normal distribution in order to represent such traffic are also presented.
Mobile nodes are typically equipped with multiple radios and can connect to multiple radio access networks (e.g. WiFi, LTE and 5G). Consequently, it is important to design mechanisms that efficiently manage multiple network interfaces for aggregating the capacity, steering of traffic flows or switching flows among multiple interfaces. While such multi-access solutions have the potential to increase the overall traffic throughput and communication reliability, the variable latencies on different access links introduce packet delay variation which has negative effect on the application quality o…
Over the last years many technological advances were introduced in Internet television to meet user needs and expectations. However due to an overwhelming bandwidth requirements traditional IP-based television service based on simple client-server approach remains restricted to small group of clients. In such situation the use of the peer-to-peer overlay paradigm to deliver live television on the Internet is gaining increasing attention. Unfortunately the current Internet infrastructure provides only best effort services for this kind of applications and do not offer quality of service. This p…
Internet censors seek ways to identify and block internet access to information they deem objectionable. Increasingly, censors deploy advanced networking tools such as deep-packet inspection (DPI) to identify such connections. In response, activists and academic researchers have developed and deployed network traffic obfuscation mechanisms. These apply specialized cryptographic tools to attempt to hide from DPI the true nature and content of connections. In this survey, we give an overview of network traffic obfuscation and its role in circumventing Internet censorship. We provide historical a…
Since the end of 2019, the SARS-CoV-2 virus known as COVID-19 has spread rapidly around the world, forcing many governments to impose restrictive blocking or lockdown to combat the pandemic. With locomotion restriction of people in almost of countries of the world, workers and students needed to keep their activities at home. As a result, people's behavior, habits, and the way they started using the Internet changed significantly. Like professionals of offices, the younger played an important role in this behavior, especially in the type of resources used by them. As result, the characterizati…
Getting good statistical models of traffic on network links is a well-known, often-studied problem. A lot of attention has been given to correlation patterns and flow duration. The distribution of the amount of traffic per unit time is an equally important but less studied problem. We study a large number of traffic traces from many different networks including academic, commercial and residential networks using state-of-the-art statistical techniques. We show that traffic obeys the log-normal distribution which is a better fit than the Gaussian distribution commonly claimed in the literature.…
The Internet is the most complex system ever created in human history. Therefore, its dynamics and traffic unsurprisingly take on a rich variety of complex dynamics, self-organization, and other phenomena that have been researched for years. This paper is a review of the complex dynamics of Internet traffic. Departing from normal treatises, we will take a view from both the network engineering and physics perspectives showing the strengths and weaknesses as well as insights of both. In addition, many less covered phenomena such as traffic oscillations, large-scale effects of worm traffic, and …
Internet traffic on a network link can be modeled as a stochastic process. After detecting and quantifying the properties of this process, using statistical tools, a series of mathematical models is developed, culminating in one that is able to generate ``traffic'' that exhibits --as a key feature-- the same difference in behavior for different time scales, as observed in real traffic, and is moreover indistinguishable from real traffic by other statistical tests as well. Tools inspired from the models are then used to determine and calibrate the type of activity taking place in each of the ti…
With the inevitable dominance of video traffic on the Internet, providing perceptually good video quality is becoming a challenging task. This is partly due to the bursty nature of video traffic, changing network conditions and limitations of network transport protocols. This growth of video traffic has made Quality of Experience (QoE) of the end user the focus of the research community. In contrast, Internet service providers are concerned about maximizing revenue by accepting as many sessions as possible, as long as customers remain satisfied. However, there is still no entirely satisfactory…
Due to the COVID-19 pandemic, many governments imposed lock downs that forced hundreds of millions of citizens to stay at home. The implementation of confinement measures increased Internet traffic demands of residential users, in particular, for remote working, entertainment, commerce, and education, which, as a result, caused traffic shifts in the Internet core. In this paper, using data from a diverse set of vantage points (one ISP, three IXPs, and one metropolitan educational network), we examine the effect of these lockdowns on traffic shifts. We find that the traffic volume increased by …
The plethora of Internet of Things (IoT) devices leads to explosive network traffic. The network traffic classification (NTC) is an essential tool to explore behaviours of network flows, and NTC is required for Internet service providers (ISPs) to manage the performance of the IoT network. We propose a novel network data representation, treating the traffic data as a series of images. Thus, the network data is realized as a video stream to employ time-distributed (TD) feature learning. The intra-temporal information within the network statistical data is learned using convolutional neural netw…
