Modeling network traffic data by doubly stochastic point processes with self-similar intensity process and fractal renewal point process. S. Barbarossa ...
Modeling network traffic data by doubly stochastic point processes with self-similar intensity process and fractal renewal point process S.Barbarossa, A.Scaglione, A. Baiocchi, G. Colletti Infocom Dept., Univ. of Rome “La Sapienza”, via Eudossiana 18, 00184 Roma, ITALY sergio, m a s , andrea@infocom. ing.uniroma1. it, Fax: (+39) 6-4873300
Abstract I n this paper w e propose a doubly stochastic point process f o r modeling traffic data. T h e traffic intensity is modeled as a self-similar process and is generated applying a n inverse orthogonal wavelet transform to a sequence of independent r a n d o m sequences, having different variances at different scales. T h e underlying point process is characterized b y a fractal renewal point process of d i m e n s i o n less t h a n one. T h e proposed model is intrinsically able t o synthesize a point process characterized b y arrivals packed i n t o sparsely located clusters separated b y occasionally very long interarrival tames. This behavior is o f t e n encountered o n real traffic data and i t deserves a particular attention because is often the m a i n responsible f o r packet losses and thus directly affects the network performance. T h e model is validated comparing the packet loss rate of a queueing buffer element driven by real and simulated trafic.
1 Introduction Recent experimental analyses have demonstrated the self-similar nature of the traffic on telecommunications networks, with specific reference t o Ethernet traffic [7], Common Channel Signaling Network (CCSN) traffic data [5], and Variable-Bit-Rate (VBR)video traffic [3]. Self-similarity manifests its presence through a number of equivalent behaviors, namely: i) autocorrelation function decaying hyperbolically fast, implying a non-summable autocorrelation function (property often identified as long-range dependence (LRD));ii) spectral density function obey= alf-Y, ing a power law near the origin, i.e. Sm(f) with 0 < y < 1, implying a non-finite value of the power spectral density at the origin; iii) variance of the sample mean over h samples decreasing more slowly than the reciprocal of the sample size. These proper-
ties are in stark contrast with commonly used models, based on Markov-modulated Poisson point processes (MMPP), exhibiting a short-range sependence (SRD). The fractal-like behavior, mainly its bursty nature, has serious implications for the design, control, and analysis of high speed, e.g. asynchronous transfer mode (ATM) networks. Real traffic is often characterized by clusters comprising several packets separated by long interarrival times and this behavior directly affects the network performance. In fact, long bursts of packets saturate the buffer memory thus causing the loss of successive packets arriving a t the same buffer. According to the experimental analysis carried out on measured data, a realistic traffic model should incorporate a heavy tail probability density function (pdf) for the interarrival times and a self-similar behavior of the traffic intensity process. Moreover, a good traffic simulator should be characterized by: i) a limited number of parameters; ii) an efficient generation method; iii) good capability of predicting the system performance under variable load conditions. To accomodate all these r e quirements, we propose a doubly stochastic point process whose intensity is a self-similar process by construction, whereas the underlying point process has interarrivals characterized by a fractal renewal process. The self-similarity property allows us to take into account the long range dependence aspect, whereas the fractal nature of the interarrival times allows the generation of clusters of packets separated by long interarrivals. The validation of the proposed model is done following an engineering approach, i.e. trying to fit the performance (e.g. packet loss rate as a function of buffer size and network average load), obtained driving a queueing buffer with real and simulated data. The paper is organized as follows: in Section 2 we show a wavelet-based analysis of data obtained by packetizing measured Ethernet data according t o the Asynchronous Transfer Mode (ATM) protocol; the algorithm for the generation of the traffic traces according
1112 1058-6393/98 $10.00 0 1998 IEEE
t o our proposed model is described in Section 3 and the performance is shown in Section 4.
2
Multiscale analysis of measured traffic data
Given the self-similar nature of real traffic data, the wavelet transform arises rather naturally as a basic analysis tool, e.g. see [I], [a]. Indeed, a simple method for investigating the self-similar nature of a process is to analyze the variance of the wavelet expansion coefficients as a function of the scale: for a self-similar = 42-^lm, process the behavior of the variance is where m is the scale and 0 < y < 1. More specifically, Abry e t al. analyzed measured traffic data using wavelets and proposed a method for estimating the Hurst parameter, which is characteristic parame ter revealing the self-similarity of a process. The Ethernet traffic data analyzed in [a] is composed of variable length packets. However, in view of the importance of ATM for high speed data networks, i.e. of a transfer mode based on fixed length cells, it is particularly important to extend the wavelet based analysis to equivalent ATM traffic data. Because of the lack of an equivalent ATM traffic data, we generated our data base by "packetizing" the measured Ethernet data into ATM cells, i.e. converting each incoming packet into a sequence of consecutive ATM cells of fixed length. The results of the wavelet based analysis, based on the analysis filterbank reported in Fig.la), where Daubechies filters of order 16 have been used (41, are reported in Fig.2. The three curves show the variance of the
-14
-3 2
-10
-6
-8
4
-2
I
m
Figure 2. - Variance of the wavelet coefficients as a function of the scale.
wavelet transform coefficients as a function of the scale m of traffic data measured over three different time scale units T , i.e. T=0.01 sec, T=0.1 sec, and T=l sec. It is very interesting t o observe: i) a nearly linear behavior of the logarithm of the variance vs. the scale m; ii) a similar slope of the three curves, at least for m > -9 (it is useful t o point out that the estimates performed for low values of m are less reliable because are done on a reduced number of data). The behavior shown in Fig.2 is characteristic of a self-similar process. Moreover, the computation of the histograms of the wavelet expansion coefficients showed that in most cases they can be well modeled as random variables having probability density function:
such variables have zero mean and variance P: = 2r 3 ' a Moreover, at least for T=0.1 sec, the ex.#. pansion coefficients can be well modeled as Gaussian random variables (i.e. a = 2 in (1)). More precisely, statistical tests run on the wavelet expansion coefficients showed that the Gaussianity assumption cannot be discarded with more than 95% of probability. This property will be used in the synthesis procedure.
3
Figure 1. - Filterbank implementation of the wavelet transform: a) analysis: b) synthesis.
Synthesis of doubly stochastic point process
The basic steps of our proposed model are the following: i) given a time interval of duration To = N T seconds, generate an intensity process I ( n ) , n = 0,1, . . . , N - 1, whose generig nth entry is the traffic inten; for each n, sity in the time interval (nT,(n+ 1 ) T ] ii) generate a point process whose corresponding renewal process has a heavy tailed pdf and whose intensity is
1113
izon
i) is implemented using the synthesis filterbank illustrated in Fig.lb), according to the following algorithm, whose inputs are two parameters only: the exponent y of the power spectral density decaying law and the traffic average value ,U.
,.
ioon
,I 8no -
s
$
6nn-
/
/
I
I
-
t
generate M = Zoga(N) vectors z(-'), of length L1 = N / 2 l , with 1 = 1, . . . , M , whose elements are independent identically distributed random variables whose pdf is given by (l),and whose variance varies along the scale m according t o the law:
(p - g 2 2-71; 1 x
Figure 3. - Arrival times generated according t o proposed model.
compute the output sequence xo [n]of the synthesis filterbank of Fig.lb) which represents the sequence I [ n ]of intensities observed over the N time intervals (nT,(n l)T],with n = 0, . . . , N - 1 using as generated in the input sequences the vectors & I ) previous step and setting y P M[n]= p.
+
end. In [6] it was shown that interarrival times generated according to the multiscale framework described above tend t o have a pdf:
The sequence I [ n ]generated according to the previous scheme exhibits a self-similar behavior (e.g., see [lo]). Once we have generated the sequence of intensit.ies, we can generate the arrival times according to the following
conditioned to the belonging of x to a finite length interval (the conditioning is necessary to insure the normalizability of (6) for y < 1). The convergence towards (6) is good provided that the following inequality holds:
Algorithm 2: for n = 0 , . . . , N - 1
1. generate a sequence A[Z] of independent identically distributed (iid) random variables (IT)having an exponential probability density function (pdf):
2. generate a sequence of interarrivals Wo[l]as iid exponential rv's whose mean arrival time is I [ n ] generated by means of Algorithm 1;
3. compute multiscale interarrival sequence: (3)
4. compute the number of interarrivals p as the smallest integer such that:
to control both large scale and small scale phenomena:
P
c X [ l ]< T ; 1=1
(4)
5. compute j t h arrival time inside nth sub-interval t(n,j ) as:
where X is the average traffic intensity. The choice of al and u2 in step 1 have been made trying to get the best fitting with the measured traffic traces (for T = 0.1 sec, we obtained a1 = -19, a2=4). Within each generic nth interval, the multiscale synthesis procedure is basically the same as the one proposed by Lam and Wornell [6]. However, the overall point process is completely different because in our model the underlying point process is modulated by a traffic intensity which is a self-similar process, whereas the approach followed in [6] assumes a k e d value of the intensity process. The basic property of our approach is that it provides the possibility We control the large scale aspects, like the long range dependence, acting on the intensity process I [ n ] ,and the small scale properties, like the presence of arrivals packed into sparsely located clusters separated by occasionally very long interarrivals, acting on the multiscale renewal process. Indeed, these properties are both equally important to synthesize a point process able to fit the measured data, at least as far as the traffic traces analyzed up to now.
1114
4 Performance analysis and model validation An example of arrival time generated according t o the previous algorithm is shown in Fig.3, where we can observe the bursty nature of the arrival times. A fundamental feature of a traffic generator is to provide reliable data that can be used instead of experimental traffic traces t o assess the performance and/or to dimension the network elements that should deal with such a traffic. This section presents the results of a basic test made on the proposed traffic generator. The test consists in feeding a first-in-first-out (FIFO) buffering element with a traffic trace produced by the proposed generator (simulated traffic traces). The main parameters used for characterizing the buffer unit are the following: K is the buffer size; 0 is the time necessary t o time out one unit cell from the buffer; N ( t ) is the number of elements present in the buffer at time t (of course N ( t ) < K ) ; w(t) is the worklord, defined as the time necessary t o empty the buffer, at time t ; its relationship with N ( t ) and 0 is: w(t) = N(t)O. LO is the length of a cell, in bits ( L O= 384 bits, fOr ATM traffic); A is the average cell arrival time rate, or the average number of cells arriving in a time unit (1 sec); C is the capacity of the test queueing system or, equivalently, the speed with which cells are timed out from the buffer, expressed in number of bits timed out in the unit time; C , Lo and 8 are related through the following expression: 6 = where p is the average load defined as: p = AB. The pictorial graphic shown in Fig.4 can help to explain the ‘loss of packet’ event. The graphic shows the worklord w(t) as a function of time t. Each time there is a new arrival, the worklord has a ‘jump’ of a fixed amount (the picture refers to fixed-length packets). Then, the buffer times out bits at a fixed velocity, which explains the straight line segments with negative slope. There is a packet loss if w(t) exceeds KO, because the buffer cannot hold more than K packets. Unless otherwise stated, in the following it is assumed that the experimental traffic data consists of a 20sec trace, divided into L intervals, each lasting T seconds ( L T = 20sec). The default values in the following are T = O.lsec and hence L = 200. The input parameters of the traffic generator are the mean and variance of the number of bytes per interval T and the y coefficient of the original LAN traffic experimental data (see Section 3). Since the definition of the interval T is needed for generation purposes, different values of T have been used. The outcome of the generator is a sequence of arrival times of ATM cells (i.e. 48 bytes of Ethernet packet data are filled in each ATM cell). Given the above relationships among
9
d
t
Figure 4. -Example of a loss of packet event.
the network parameters, the test queueing system is completely described by means of two parameters: we choose the mean load p and the buffer size (in cells) K . Figs. 5 to 6 plot the loss probability n obtained by averaging over 50 different realizations of the process, as a function of K for p = 0.5, and 0.8, respectively. Each realization lasts 2Osec. The solid line refers to the cell loss ratio measured on the real traffic sequence, whereas isolated dots refer to the simulated traffic (two different values of T are considered: T = O.lsec and T = lsec). Comparing the results pertaining to real and simulated traffic, we can observe a more than satisfactory agree merit for p = 0.5 and p = 0.8. In both cases, the choice T = 0.lsec leads to the most accurate results. Indeed the best choice for T results from a tradeoff between contrasting needs: on one hand, we would like t o take T as small as possible t o better grasp the small scale aspects of the traffic intensity; on the other hand, we would like to use a large T , t o make our estimate of the traffic intensity more reliable. Furtheniore, as far as the pdf of the wavelet expansion coefficients is concerned (e.g., see (l)),we have assumed a Gaussian distribution which, according to our tests on real data, provides a good model for T = O.lsec, but, is not as good for T = lsec. Figs.5 and 6 report also the performance obtained using a fluid stochastic model (dashed lines), which is a model largely employed t o evaluate the performance of a queueing system Ill]. This model disregards the discrete nature of the packet arrival process and is based only on the intensity process. To make a fair comparison between our model and the fluid model, we used the same intensities in both cases, i.e. the intensity p r e cess generated using wavelets, as described in Section 3. In this way, both processes retain the same longrange dependency observed on the real traffic, the only difference being the underlying point process which, in our case is a fractal renewal point process whereas,
1115
0,s
according to the fluid model, packets are assumed to arrive uniformly distributed over the interval T .
I
0
0,6
.-+
2) Simulation (T=O.ls) 3) Simulation (T=l s ) 4) Fluid model
0
E
0 2) Simulation (T=O.l s) 0 3) Simulation (T=l s)
- 0,4
4)Fluid model
-
3
100
I”
0
100
200
300
400
500
600
400 500 Buffer size (cells)
300
600
I 700
Figure 6 . - Comparison between the cell loss ratio Values obtained by means o f real and simulated traffic data for the test queue load p = 0.8.
700
Buffer slze (cells)
Figure 5. - Comparison between the cell loss ratio Values obtained by means o f real and simulated traffic data for the test queue load p = 0.5.
5
200
I E E E Trans actions o n Communications, pp .156 6- 1579, Vo1.43, No.21314, Febr., MarchIApril 1995. 141 LDaubechies, “Orthonormal bases of compactly supported wavelets” Comm. Pure Appl. Math., ~01.41,
Conclusion
pp.909-996, NOV.1988. In this paper we have proposed a method for synthesizing traffic over high speed telecommunication networks. The model has been validated testing the performance of a queueing buffer element driven by the synthesized traffic and by real traffic data. Comparing the performance of our method with the stochastic fluid model, from Figs.5 and 6 is evident that our model is much more suitable to reproduce the features of real traffic than the fluid stochastic model. This means that both aspects of the proposed doubly sthocastic process, namely self-similar traffic intensity and fractal renewal point process, are essential t o model the real traffic properly. Further analyses should be addressed to a better fitting of the pdf of the wavelet expansion coefficients, checking the validity of ( l ) ,and estimating its parameters, as a function of the time interval T .
References P. Abry, P. Goncalves, P. Flandrin, “Wavelets, Spectrum Analysis and l / f Processes” in : Wavelets and Statistics (A. Antoniadis, eds.) Lecture Notes in Statistics 103, pp. 15-29, Springer, 1995.
151 D.E.Duffy, A.A.McIntosh, M.Rosenstein, W.Willinger, “Statistical Analysis of CCSN/SS7 Traffic Data from Working CCS Subnetworks” I E E E Journal o n Selected Areas in Communications, pp. 544-551, V01.12, No.3, April 1994. (61 W.M.Lam, G.W.Wornel1, “Multiscale Representation and Estimation of Fractal Point Processes” I E E E Transactions o n Signal Processing, Vo1.43, No. 11, pp.2606-2617,Nov.1995. [7] W.E.Leland, M.S.Taqqu, W.Willinger, D.V.Wilson, “On the Self-similar Nature of Ethernet Traffic (Extended Version)” IEEE-ACM Transactions o n Networkng, pp. 1-15, V01.2, No.1, Febr. 1993.
[SI S.B. Lowen and M.C. Teich. “Estimation and simulation of fractal stochastic point processes.” Fractals, vo1.3, pp.183-210, 1995. [9] B.K.Ryu, S.B.Lowen “Point-Processes Approaches to t h e Modeling and Analysis of Self-similar Traffic - Part I: Model Construction” Proc. of the IEEE Conf. INFOCOM ’96, pp.1468-1475, 1996.
~
P. Abry, P. Flandrin, “Point Processes, Long-Range Dependence and Wavelets” in : Wavelets in Biology and Medicine (A. Aldroubi and M. Unser, eds.), pp. 413437, CRC Press, 1996.
(101 G.W.Wornel1, “Wavelet-BasedRepresentations for the l / f Family of Fractal Processes” Proceedings of the IEEE, vol.81, No.10, pp.1428-1450, Oct.1993.
[11] D. Mitra “Stochastic theory of a fluid model of producers and consumers coupled by a buffer” Adv. Appl. Prob., 20 pp.646-676, 1988.
J.Beran R.Sherrnan, M.S.Taqqu, W.Willinger, “LongRange Dependence in Variable-Bit-Rate Video Traffic” ~
1116
