![Page 1: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/1.jpg)
Rapid Detection of
Constant-Packet-Rate Flows
ARES 2008, 03/05 1
Jing-Kai Lou, Kuan-Ta ChenInstitute of Information Science, Academia Sinica
![Page 2: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/2.jpg)
Talk Outline
MotivationInvestigationPerformance EvaluationSummary
ARES 2008, 03/05 2
![Page 3: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/3.jpg)
Motivation
Popular real-time and interactive applications:VoIP, Real-time network games
Traffic management Need of flow identificationA distinct characteristic of such traffic: Constant Packet Rate
VoIP: Encoded continuous human voiceReal-time network game: game state updates
Key to identify VoIP and online gaming traffic:CPR flow identification
ARES 2008, 03/05 3
![Page 4: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/4.jpg)
Key Contribution
A CPR traffic classifierLightweight
10 successive inter-packet timesHigh Accuracy90% identification rate
ARES 2008, 03/05 4
Client Client
Traffic stream
![Page 5: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/5.jpg)
A Naive Method
Coefficient of Variation (CoV) of Inter-Packet Times (IPT)
IPT CoV small CPRIPT CoV large non-CPR
ARES 2008, 03/05 5
IPT1 IPT2 … IPTi
CPR Traffic IPT1= IPT1=…= IPTi
![Page 6: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/6.jpg)
Ideal IPT Distribution
ARES 2008, 03/05 6Inter-packet time (ms)
0 200 400 600 800 1000
0
1
Den
sity
![Page 7: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/7.jpg)
Collected Traces
ARES 2008, 03/05 7
Trace Flow IPT CoV Path Diversity
VoIP (Skype) 1739 0.37 1106 hosts / 1641 paths
Counter-Strike 1016 0.32 271 hosts / 270 paths
TELNET 276 1.53 140 hosts / 93 paths
HTTP 409 1.54 474 hosts / 325 paths
P2P 1303 1.63 645 hosts / 644 paths
World of Warcraft 1611 0.71 52 hosts / 39 paths
![Page 8: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/8.jpg)
Real IPT Distributions
ARES 2008, 03/05 8
Why the IPT distributions of VoIP and Counter-Strike are not as we expect?
![Page 9: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/9.jpg)
Difficulties: Network Impairment
Host delayChannel delayNetwork queueing delayNetwork packet loss
ARES 2008, 03/05 9
CPR traffic
Sender
packet lossdelayafter network impairment
![Page 10: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/10.jpg)
More Difficulties
To do a decision with a few samplesshort timefew storage space
In short scale, non-CPR traffic could look like CPR
ARES 2008, 03/05 10
Non-CPR Flow
![Page 11: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/11.jpg)
RefreshmentOur goal
To search a good metric of IPT deviations for CPR detection
ChallengesNetwork impairmentNeed of small sample size
ARES 2008, 03/05 11
![Page 12: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/12.jpg)
Deviation Metric Design
Design factors for measuring variation Function (FUN)Sample Size (W)Smoother Size (S)
ARES 2008, 03/05 12
![Page 13: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/13.jpg)
Deviation Metric: Function (1/3)
Standard Deviation (SD)
Coefficient of variation (CoV)
ARES 2008, 03/05 13
NIPTIPTSD i
Ni
21 )( −∑
= =
MEANSDCoV =
![Page 14: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/14.jpg)
Deviation Metric: Function (2/3)
Mean absolute deviation (MD)
Median absolute deviation (MAD)
ARES 2008, 03/05 14
NIPTIPTMAD i
Ni |)(|1 −∑
= =
NIPTmedianIPTMAD i
Ni |))((|1 −∑
= =
![Page 15: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/15.jpg)
Deviation Metric: Function (2/3)
Inter-quantile range (IQR)
Range
ARES 2008, 03/05 15
(25%) QuartileLower (75%) QuartileUpper IQR −=
min(IPT)max(IPT)Range −=
![Page 16: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/16.jpg)
Deviation Metric: Sample Size
Sample size (W): Number of IPT samplesW increases
Accuracy increasesTime/space complexity increases
ARES 2008, 03/05 16
SampleSize
Time/SpacecomplexityAccuracy
![Page 17: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/17.jpg)
Deviation Metric: Smoother Size
Smoother size (S): Window size to smooth (mean)W increases
Impairment effect decreasesFalse negative increases
ARES 2008, 03/05 17
WindowSize
FalseNegative
Impairmenteffect
![Page 18: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/18.jpg)
FUN=CoV, W=10, S=1
ARES 2008, 03/05 18
Does this estimator setting achieve the best discriminative
power??
![Page 19: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/19.jpg)
![Page 20: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/20.jpg)
Performance Metric
ROC (Receiver Operating Characteristic):TPR: ratio of true positiveFPR: ratio of false positive
AUC (Area Under Curve): Area under the ROC curveAUC = 1, perfect classificationAUC > 0.8, generally goodAUC = 0.5 random guess
ARES 2008, 03/05 20
![Page 21: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/21.jpg)
Effect of Deviation Metric
ARES 2008, 03/05 21
Dimensionless metric CoV performs the best!
![Page 22: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/22.jpg)
Effect of Sample Size
ARES 2008, 03/05 22
Sample size increasesROC Curve shifts left AUC increases
![Page 23: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/23.jpg)
Effect of Smoother Size
ARES 2008, 03/05 23
Improvement only for large samples
![Page 24: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/24.jpg)
Discrimination Performance
ARES 2008, 03/05 24
![Page 25: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/25.jpg)
Summary
Proposed using IPT constancy to identify CPR flows VoIPReal-time gaming
Studied various design issues of IPT deviation estimators
Our classifier (CoV-based) yields an accuracy rate 90% with only 10 IPT samples
ARES 2008, 03/05 25
![Page 26: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/26.jpg)
ARES 2008, 03/05 26
![Page 27: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/27.jpg)
![Page 28: Rapid Detection of Constant-Packet-Rate Flows](https://reader031.vdocuments.mx/reader031/viewer/2022020217/54930a64b47959962d8b55ff/html5/thumbnails/28.jpg)
ARES 2008, 03/05 28
packet loss
delay
after network impairment
Receiver