0
Rapid Detection of
 Constant-Packet-Rate Flows

               Jing-Kai Lou, Kuan-Ta Chen
     Institute of Information Sc...
Talk Outline
   Motivation
   Investigation
   Performance Evaluation
   Summary




ARES 2008, 03/05            2
Motivation
   Popular real-time and interactive applications:
     VoIP, Real-time network games
   Traffic management
   ...
Key Contribution
   A CPR traffic classifier
     Lightweight
     10 successive inter-packet times
     High Accuracy
   ...
A Naive Method
   Coefficient of Variation (CoV) of Inter-Packet Times
   (IPT)
     IPT CoV small     CPR
     IPT CoV la...
Ideal IPT Distribution
        1
  Density




        0

            0   200        400            600   800   1000
     ...
Collected Traces

       Trace          Flow   IPT CoV       Path Diversity
    VoIP (Skype)      1739    0.37     1106 ho...
Real IPT Distributions




             Why the IPT distributions of VoIP and
           Counter-Strike are not as we expe...
Difficulties: Network Impairment
   Host delay
   Channel delay
   Network queueing delay
   Network packet loss

        ...
More Difficulties
    To do a decision with a few samples
      short time
      few storage space


    In short scale, n...
Refreshment
   Our goal
     To search a good metric of IPT deviations for CPR detection


   Challenges
     Network impa...
Deviation Metric Design
   Design factors for measuring variation
     Function (FUN)
     Sample Size (W)
     Smoother S...
Deviation Metric: Function (1/3)
   Standard Deviation (SD)
                ∑iN 1 ( IPTi − IPT ) 2
           SD =   =
   ...
Deviation Metric: Function (2/3)
   Mean absolute deviation (MD)

                     ∑iN 1 | ( IPTi − IPT ) |
          ...
Deviation Metric: Function (2/3)
   Inter-quantile range (IQR)


     IQR = Upper Quartile (75%) − Lower Quartile (25%)


...
Deviation Metric: Sample Size
   Sample size (W): Number of IPT samples
   W increases
     Accuracy increases
     Time/s...
Deviation Metric: Smoother Size
   Smoother size (S): Window size to smooth (mean)
   W increases
     Impairment effect d...
FUN=CoV, W=10, S=1



                   Does this estimator setting
              achieve the best discriminative
       ...
Performance Metric
   ROC (Receiver Operating Characteristic):
     TPR: ratio of true positive
     FPR: ratio of false p...
Effect of Deviation Metric




        Dimensionless metric CoV performs the best!

ARES 2008, 03/05                      ...
Effect of Sample Size
Sample size increases
   ROC Curve shifts left
  AUC increases




ARES 2008, 03/05           22
Effect of Smoother Size




                   Improvement only for
                   large samples



ARES 2008, 03/05  ...
Discrimination Performance




ARES 2008, 03/05              24
Summary
   Proposed using IPT constancy to identify CPR flows
     VoIP
     Real-time gaming


   Studied various design ...
ARES 2008, 03/05   26
packet loss




            delay




    after network impairment




                               Receiver
ARES 2008, ...
Rapid Detection of Constant-Packet-Rate Flows
Rapid Detection of Constant-Packet-Rate Flows
Upcoming SlideShare
Loading in...5
×

Rapid Detection of Constant-Packet-Rate Flows

444

Published on

The demand for effective VoIP and online gaming traffic management methods continues to increase for purposes such as QoS provisioning, usage accounting, and blocking VoIP calls or game connections. However, identifying such flows has become a significant administrative burden because many of the applications use proprietary signaling and transport protocols. The question of how to identify proprietary VoIP traffic has yet to be solved.

In this paper, we propose using a deviation-based classifier to identify VoIP and gaming traffic, given that such real-time interactive services normally send out constant-packet-rate (CPR) traffic with a fixed interval, in order to maintain real-timeliness and interactivity. Our contribution is two-fold: 1) We show that scale-free variability measures are more appropriate than scaledependent ones for quantifying the network variability injected into CPR traffic. 2) Our proposed classifier is particularly lightweight in that it only requires a few inter-packet times to make a decision. The evaluation results show that by only analyzing 10 successive inter-packet times, we can distinguishbetween CPR and non-CPR traffic with approximately 90% accuracy.

Published in: Technology, Business
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
444
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
6
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Transcript of "Rapid Detection of Constant-Packet-Rate Flows"

  1. 1. Rapid Detection of Constant-Packet-Rate Flows Jing-Kai Lou, Kuan-Ta Chen Institute of Information Science, Academia Sinica ARES 2008, 03/05 1
  2. 2. Talk Outline Motivation Investigation Performance Evaluation Summary ARES 2008, 03/05 2
  3. 3. Motivation Popular real-time and interactive applications: VoIP, Real-time network games Traffic management Need of flow identification A distinct characteristic of such traffic: Constant Packet Rate VoIP: Encoded continuous human voice Real-time network game: game state updates Key to identify VoIP and online gaming traffic: CPR flow identification ARES 2008, 03/05 3
  4. 4. Key Contribution A CPR traffic classifier Lightweight 10 successive inter-packet times High Accuracy 90% identification rate Client Client Traffic stream ARES 2008, 03/05 4
  5. 5. A Naive Method Coefficient of Variation (CoV) of Inter-Packet Times (IPT) IPT CoV small CPR IPT CoV large non-CPR CPR Traffic IPT1= IPT1=…= IPTi IPT1 IPT2 … IPTi ARES 2008, 03/05 5
  6. 6. Ideal IPT Distribution 1 Density 0 0 200 400 600 800 1000 Inter-packet time (ms) ARES 2008, 03/05 6
  7. 7. Collected Traces Trace Flow IPT CoV Path Diversity VoIP (Skype) 1739 0.37 1106 hosts / 1641 paths Counter-Strike 1016 0.32 271 hosts / 270 paths TELNET 276 1.53 140 hosts / 93 paths HTTP 409 1.54 474 hosts / 325 paths P2P 1303 1.63 645 hosts / 644 paths World of Warcraft 1611 0.71 52 hosts / 39 paths ARES 2008, 03/05 7
  8. 8. Real IPT Distributions Why the IPT distributions of VoIP and Counter-Strike are not as we expect? ARES 2008, 03/05 8
  9. 9. Difficulties: Network Impairment Host delay Channel delay Network queueing delay Network packet loss packet loss delay traffic CPR after network impairment Sender ARES 2008, 03/05 9
  10. 10. More Difficulties To do a decision with a few samples short time few storage space In short scale, non-CPR traffic could look like CPR Non-CPR Flow ARES 2008, 03/05 10
  11. 11. Refreshment Our goal To search a good metric of IPT deviations for CPR detection Challenges Network impairment Need of small sample size ARES 2008, 03/05 11
  12. 12. Deviation Metric Design Design factors for measuring variation Function (FUN) Sample Size (W) Smoother Size (S) ARES 2008, 03/05 12
  13. 13. Deviation Metric: Function (1/3) Standard Deviation (SD) ∑iN 1 ( IPTi − IPT ) 2 SD = = N Coefficient of variation (CoV) SD CoV = MEAN ARES 2008, 03/05 13
  14. 14. Deviation Metric: Function (2/3) Mean absolute deviation (MD) ∑iN 1 | ( IPTi − IPT ) | MAD = = N Median absolute deviation (MAD) ∑iN 1 | ( IPTi − median( IPT )) | MAD = = N ARES 2008, 03/05 14
  15. 15. Deviation Metric: Function (2/3) Inter-quantile range (IQR) IQR = Upper Quartile (75%) − Lower Quartile (25%) Range Range = max(IPT) − min(IPT) ARES 2008, 03/05 15
  16. 16. Deviation Metric: Sample Size Sample size (W): Number of IPT samples W increases Accuracy increases Time/space complexity increases Sample Time/Space Accuracy Size complexity ARES 2008, 03/05 16
  17. 17. Deviation Metric: Smoother Size Smoother size (S): Window size to smooth (mean) W increases Impairment effect decreases False negative increases Impairment Window effect False Size Negative ARES 2008, 03/05 17
  18. 18. FUN=CoV, W=10, S=1 Does this estimator setting achieve the best discriminative power?? ARES 2008, 03/05 18
  19. 19. Performance Metric ROC (Receiver Operating Characteristic): TPR: ratio of true positive FPR: ratio of false positive AUC (Area Under Curve): Area under the ROC curve AUC = 1, perfect classification AUC > 0.8, generally good AUC = 0.5 random guess ARES 2008, 03/05 20
  20. 20. Effect of Deviation Metric Dimensionless metric CoV performs the best! ARES 2008, 03/05 21
  21. 21. Effect of Sample Size Sample size increases ROC Curve shifts left AUC increases ARES 2008, 03/05 22
  22. 22. Effect of Smoother Size Improvement only for large samples ARES 2008, 03/05 23
  23. 23. Discrimination Performance ARES 2008, 03/05 24
  24. 24. Summary Proposed using IPT constancy to identify CPR flows VoIP Real-time gaming Studied various design issues of IPT deviation estimators Our classifier (CoV-based) yields an accuracy rate 90% with only 10 IPT samples ARES 2008, 03/05 25
  25. 25. ARES 2008, 03/05 26
  26. 26. packet loss delay after network impairment Receiver ARES 2008, 03/05 28
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×