Rapid Detection of Constant-Packet-Rate Flows
Upcoming SlideShare
Loading in...5
×
 

Rapid Detection of Constant-Packet-Rate Flows

on

  • 648 views

The demand for effective VoIP and online gaming traffic management methods continues to increase for purposes such as QoS provisioning, usage accounting, and blocking VoIP calls or game connections. ...

The demand for effective VoIP and online gaming traffic management methods continues to increase for purposes such as QoS provisioning, usage accounting, and blocking VoIP calls or game connections. However, identifying such flows has become a significant administrative burden because many of the applications use proprietary signaling and transport protocols. The question of how to identify proprietary VoIP traffic has yet to be solved.

In this paper, we propose using a deviation-based classifier to identify VoIP and gaming traffic, given that such real-time interactive services normally send out constant-packet-rate (CPR) traffic with a fixed interval, in order to maintain real-timeliness and interactivity. Our contribution is two-fold: 1) We show that scale-free variability measures are more appropriate than scaledependent ones for quantifying the network variability injected into CPR traffic. 2) Our proposed classifier is particularly lightweight in that it only requires a few inter-packet times to make a decision. The evaluation results show that by only analyzing 10 successive inter-packet times, we can distinguishbetween CPR and non-CPR traffic with approximately 90% accuracy.

Statistics

Views

Total Views
648
Views on SlideShare
629
Embed Views
19

Actions

Likes
0
Downloads
4
Comments
0

2 Embeds 19

http://mmnet.iis.sinica.edu.tw 18
http://www.slideshare.net 1

Accessibility

Categories

Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

    Rapid Detection of Constant-Packet-Rate Flows Rapid Detection of Constant-Packet-Rate Flows Presentation Transcript

    • Rapid Detection of Constant-Packet-Rate Flows Jing-Kai Lou, Kuan-Ta Chen Institute of Information Science, Academia Sinica ARES 2008, 03/05 1
    • Talk Outline Motivation Investigation Performance Evaluation Summary ARES 2008, 03/05 2
    • Motivation Popular real-time and interactive applications: VoIP, Real-time network games Traffic management Need of flow identification A distinct characteristic of such traffic: Constant Packet Rate VoIP: Encoded continuous human voice Real-time network game: game state updates Key to identify VoIP and online gaming traffic: CPR flow identification ARES 2008, 03/05 3
    • Key Contribution A CPR traffic classifier Lightweight 10 successive inter-packet times High Accuracy 90% identification rate Client Client Traffic stream ARES 2008, 03/05 4
    • A Naive Method Coefficient of Variation (CoV) of Inter-Packet Times (IPT) IPT CoV small CPR IPT CoV large non-CPR CPR Traffic IPT1= IPT1=…= IPTi IPT1 IPT2 … IPTi ARES 2008, 03/05 5
    • Ideal IPT Distribution 1 Density 0 0 200 400 600 800 1000 Inter-packet time (ms) ARES 2008, 03/05 6
    • Collected Traces Trace Flow IPT CoV Path Diversity VoIP (Skype) 1739 0.37 1106 hosts / 1641 paths Counter-Strike 1016 0.32 271 hosts / 270 paths TELNET 276 1.53 140 hosts / 93 paths HTTP 409 1.54 474 hosts / 325 paths P2P 1303 1.63 645 hosts / 644 paths World of Warcraft 1611 0.71 52 hosts / 39 paths ARES 2008, 03/05 7
    • Real IPT Distributions Why the IPT distributions of VoIP and Counter-Strike are not as we expect? ARES 2008, 03/05 8
    • Difficulties: Network Impairment Host delay Channel delay Network queueing delay Network packet loss packet loss delay traffic CPR after network impairment Sender ARES 2008, 03/05 9
    • More Difficulties To do a decision with a few samples short time few storage space In short scale, non-CPR traffic could look like CPR Non-CPR Flow ARES 2008, 03/05 10
    • Refreshment Our goal To search a good metric of IPT deviations for CPR detection Challenges Network impairment Need of small sample size ARES 2008, 03/05 11
    • Deviation Metric Design Design factors for measuring variation Function (FUN) Sample Size (W) Smoother Size (S) ARES 2008, 03/05 12
    • Deviation Metric: Function (1/3) Standard Deviation (SD) ∑iN 1 ( IPTi − IPT ) 2 SD = = N Coefficient of variation (CoV) SD CoV = MEAN ARES 2008, 03/05 13
    • Deviation Metric: Function (2/3) Mean absolute deviation (MD) ∑iN 1 | ( IPTi − IPT ) | MAD = = N Median absolute deviation (MAD) ∑iN 1 | ( IPTi − median( IPT )) | MAD = = N ARES 2008, 03/05 14
    • Deviation Metric: Function (2/3) Inter-quantile range (IQR) IQR = Upper Quartile (75%) − Lower Quartile (25%) Range Range = max(IPT) − min(IPT) ARES 2008, 03/05 15
    • Deviation Metric: Sample Size Sample size (W): Number of IPT samples W increases Accuracy increases Time/space complexity increases Sample Time/Space Accuracy Size complexity ARES 2008, 03/05 16
    • Deviation Metric: Smoother Size Smoother size (S): Window size to smooth (mean) W increases Impairment effect decreases False negative increases Impairment Window effect False Size Negative ARES 2008, 03/05 17
    • FUN=CoV, W=10, S=1 Does this estimator setting achieve the best discriminative power?? ARES 2008, 03/05 18
    • Performance Metric ROC (Receiver Operating Characteristic): TPR: ratio of true positive FPR: ratio of false positive AUC (Area Under Curve): Area under the ROC curve AUC = 1, perfect classification AUC > 0.8, generally good AUC = 0.5 random guess ARES 2008, 03/05 20
    • Effect of Deviation Metric Dimensionless metric CoV performs the best! ARES 2008, 03/05 21
    • Effect of Sample Size Sample size increases ROC Curve shifts left AUC increases ARES 2008, 03/05 22
    • Effect of Smoother Size Improvement only for large samples ARES 2008, 03/05 23
    • Discrimination Performance ARES 2008, 03/05 24
    • Summary Proposed using IPT constancy to identify CPR flows VoIP Real-time gaming Studied various design issues of IPT deviation estimators Our classifier (CoV-based) yields an accuracy rate 90% with only 10 IPT samples ARES 2008, 03/05 25
    • ARES 2008, 03/05 26
    • packet loss delay after network impairment Receiver ARES 2008, 03/05 28