A Novel Method for Estimating Flow Length Distributions from Double-Sampled Flow Statistics
A Novel Method for Estimating Flow Length Distributions from Double-Sampled Flow Statistics
复制标题
DOI：
10.1109/embeddedcom-scalcom.2009.39
复制
发表时间：
2009-09
期刊：
影响因子：
--
通讯作者：
Weijiang Liu;W. Qu;Zhaobin Liu;Keqiu Li
中科院分区：
文献类型：
--
作者：
Weijiang Liu;W. Qu;Zhaobin Liu;Keqiu Li
由于生成详细的流量统计数据不能很好地随链路速度的变化而变化，越来越多的被动流量测量采用在数据包或流级别上采样的方式。采样已经成为测量高速链路流量数据的一种有吸引力且可扩展的手段。但是，了解通过网络链路的流量长度分布对于推断流量需求、描述源流量特征和检测流量异常等应用是有用的。被动流量测量越来越多地从采样网络流量中进行推断。然而，先前的工作已经表明，当在数据包级别进行采样时，从采样流量中估计流量长度分布是不准确的。在本文中，我们提出了一种新的方法，利用由双采样数据包流形成的流量统计来推断未采样流中流量长度的绝对频率。我们通过统计推断和利用重尾羽毛来实现这一点。该方法使我们能够恢复完整的流长分布。
Since the generation of detailed traffic statistics does not scale well with link speed, increasingly passive traffic measurement employs sampling at the packet or flow level. Sampling has become an attractive and scalable means to measure flow data on high-speed links. However, knowing the length distributions of traffic flows passing through a network link is useful for some applications such as inferring traffic demands, characterizing source traffic, and detecting traffic anomalies. Passive traffic measurement increasingly makes inferences from sampled network traffic. However, previous work has shown the inaccuracy of estimating flow length distributions from sampled traffic when the sampling is performed at the packet level. In this paper, we propose a novel method that uses flow statistics formed from double-sampled packet stream to infer the absolute frequencies of lengths of flows in the unsampled stream. We achieve this through statistical inference and by exploiting heavy-tailed feather. The method allow us to recover the complete flow length distribution.