Multiscale Energy Network Tomography

Abstract

Much effort and ingenuity has been applied to develop tomographic methods to derive link-level performance statistics (packet delay and loss rates) from end-to-end measurements. However, there has been recognition in recent years that network anomalies may manifest with more detailed spectral properties beyond these aggregate performance statistics. This motivates us to study whether network tomography can be used to attribute spectral properties observed in end-to-end measurements to local network regions, which would then be indicated as potential attack targets. Although spectral properties have been used to characterize network traffic and protocol and serve as features for anomaly detection, no current methods exist to localize these features to specific network links. In this paper we show how a tomographic analysis of end-to-end measurements can be used to estimate the wavelet energy of internal link delays. The proposed estimator, used for assessing link-level performance, is able to locate the link and scale with the highest energy that might be contributed by anomalies or congestion. We evaluate our method through world-wide realistic RTT measurements that shows a high estimation accuracy (100%) on identifying links/scales with the highest energy and small mean relative errors (< 0.1).