Generation and Validation of Synthetic Internet Traffic

该研究项目侧重于网络模拟中的一个关键问题，即生成依赖于应用程序、独立于网络的合成流量，该流量对应于有效的、当代的应用程序或用户行为模型。具体地说，我们将研究捕获终端用户交互和应用程序级协议动态的网络连接的抽象表示。这种表示称为a-b-t跟踪，它将连接建模为一系列由交换间思考时间分隔的请求/响应交换。网络数据包跟踪被“反向编译”成a-b-t跟踪的集合，作为合成流量生成引擎的输入。该引擎将通过各种技术，从a-b-t跟踪的集合中取样，以生成与网络无关的合成流量，该流量在统计上与原始数据包跟踪相似。该项目将调查各种流量生成技术，并将实证和数学验证每一个。此外，将研究使用统计聚类分析来识别a-b-t轨迹的子集，这些子集对应于生成统计同质流量的应用程序连接。所建议的聚类分析工作的前提是，虽然在任何时候都有成千上万的端口对在使用，但使用的不同类型的应用程序的数量要少得多。除了实现更好的控制模拟之外，提议的聚类分析技术可能会让提供商更好地了解当前在其网络上看到的流量的基本组成和结构。例如，与其在看似随机的端口对上看到2万个活动连接，他们可以识别出存在的5-10个基本流量类。这项研究的结果将有助于更准确和真实的模拟，从而更深入地了解所提出的网络技术的优点。最后，网络连接的抽象网络独立特征可以用来理解互联网流量的基本组成和演变。

This research project focuses on a critical problem in network simulations, i.e. the gener-ating of application-dependent, network-independent synthetic traffic that corresponds to a valid, contemporary model of application or user behavior. Specifically, an abstract rep-resentation of network connections will be investigated that captures the dynamics of both end-user interactions and application-level protocols. The representation, called an a-b-t trace, models connections as a series of request/response exchanges separated by inter-exchange think times. Network packet traces are "reverse compiled" into a collec-tion of a-b-t traces that serve as inputs to a synthetic traffic generation engine. The engine will, through a variety of techniques, sample from a collection of a-b-t traces to generate network-independent synthetic traffic that is statistically similar to the original packet trace. This project will investigate a variety of traffic generation techniques and will em-pirically and mathematically validate each. Furthermore, the use of statistical cluster analysis to identify subsets of a-b-t traces will be investigated that correspond to applica-tion connections that are generating statistically homogeneous traffic. The premise of the proposed cluster analysis work is that while literally tens of thousands of port pairs are in use at any one time, the number of distinct types of applications that are in use is far smaller. Beyond enabling better-controlled simulations, the proposed cluster analysis techniques will likely allow providers to better understand the fundamental make-up and structure of traffic currently seen on their networks. For example, instead of seeing 20 thousand active connections on seemingly random port pairs they can identify the 5-10 fundamental traffic classes present. The results of this research will contribute to more accurate and realistic simulations and hence a deeper understanding of the merits of pro-posed network technologies. Finally, the abstract network-independent characterization of network connections can be used to understand the fundamental makeup and evolution of Internet traffic.