Generation and Validation of Synthetic Internet Traffic

该研究项目的重点是网络模拟中的一个关键问题，即生成与应用程序相关的、与网络无关的合成流量，该流量对应于有效的、当代的应用程序或用户行为模型。具体来说，网络连接的抽象表示将被调查，捕捉最终用户交互和应用程序级协议的动态。这种表示称为a-b-t跟踪，它将连接建模为一系列由交换间思考时间分隔的请求/响应交换。网络数据包跟踪被“反向编译”为a-b-t跟踪的集合，这些跟踪用作合成流量生成引擎的输入。该引擎将通过各种技术从a-b-t跟踪的集合中进行采样，以生成在统计上与原始数据包跟踪相似的独立于网络的合成流量。本项目将研究各种流量生成技术，并将从经验和数学上验证每一种技术。此外，使用统计聚类分析，以确定子集的a-b-t跟踪将调查对应的应用程序连接，产生统计均匀的流量。所提出的聚类分析工作的前提是，虽然在任何时候都有成千上万的端口对在使用，但使用中的不同类型的应用程序的数量要小得多。除了能够更好地控制模拟之外，拟议的聚类分析技术还可能使提供商能够更好地了解其网络上当前流量的基本构成和结构。例如，他们可以识别存在的5-10个基本流量类别，而不是在看似随机的端口对上看到2万个活动连接。这项研究的结果将有助于更准确和逼真的模拟，从而更深入地了解所提出的网络技术的优点。最后，网络连接的抽象网络独立表征可以用来理解互联网流量的基本构成和演变。

This research project focuses on a critical problem in network simulations, i.e. the gener-ating of application-dependent, network-independent synthetic traffic that corresponds to a valid, contemporary model of application or user behavior. Specifically, an abstract rep-resentation of network connections will be investigated that captures the dynamics of both end-user interactions and application-level protocols. The representation, called an a-b-t trace, models connections as a series of request/response exchanges separated by inter-exchange think times. Network packet traces are "reverse compiled" into a collec-tion of a-b-t traces that serve as inputs to a synthetic traffic generation engine. The engine will, through a variety of techniques, sample from a collection of a-b-t traces to generate network-independent synthetic traffic that is statistically similar to the original packet trace. This project will investigate a variety of traffic generation techniques and will em-pirically and mathematically validate each. Furthermore, the use of statistical cluster analysis to identify subsets of a-b-t traces will be investigated that correspond to applica-tion connections that are generating statistically homogeneous traffic. The premise of the proposed cluster analysis work is that while literally tens of thousands of port pairs are in use at any one time, the number of distinct types of applications that are in use is far smaller. Beyond enabling better-controlled simulations, the proposed cluster analysis techniques will likely allow providers to better understand the fundamental make-up and structure of traffic currently seen on their networks. For example, instead of seeing 20 thousand active connections on seemingly random port pairs they can identify the 5-10 fundamental traffic classes present. The results of this research will contribute to more accurate and realistic simulations and hence a deeper understanding of the merits of pro-posed network technologies. Finally, the abstract network-independent characterization of network connections can be used to understand the fundamental makeup and evolution of Internet traffic.