Flow Inter-arrival Time Research Articles

An empirical study on TCP flow interarrival time distribution for normal and anomalous traffic

SummaryIn this paper, we study the effects of anomalies on the distribution of TCP flow interarrival time process. We show empirically that despite the variety of data networks in size, number of users, applications, and load, the interarrival times of normal flows comply with the Weibull distribution, whereas specific irregularities (anomalies) causes deviations from the distribution. We first estimate the scale and shape parameters and then check the discrepancy of the data from a Weibull distribution with the estimated parameters. We also utilize the Weibull counting model to recheck the conformance of small flow interarrival times with the distribution. We perform our experiments on a diverse variety of traffic data sets from backbone connections to endpoints of academic and commercial networks. Moreover, we propose a window‐based anomaly detection method as a possible application of our findings in which we first estimate the Weibull parameters of interarrival times in each window and then check the discrepancy of the data with a Weibull distribution with the estimated parameters and set an alarm whenever the difference is significant. We apply this method on one of our data sets and present the results to clarify the idea and show its capability in detecting volume anomalies. Copyright © 2014 John Wiley & Sons, Ltd.

Benford's law behavior of Internet traffic

In this paper, we analyze the Internet traffic from a different point of view based on Benford's law, an empirical law that describes the distribution of leading digits in a collection of numbers met in naturally occurring phenomena. We claim that Benford's law holds for the inter-arrival times of TCP flows in case of normal traffic. Consequently, any type of anomalies affecting TCP flows, including intentional intrusions or unintended faults and network failures in general, can be detected by investigating the first-digit distributions of the inter-arrival times of TCP SYN packets. In this paper we apply our findings to the detection of intentional attacks, and leave other types of anomalies for future works. We support our claim with related researches that indicate the TCP flow inter-arrival times can be modeled by Weibull distribution with shape parameter less than 1, and show the relation between Weibull distributed data and Benford's law. Finally, we validate our findings on real traffic and achieve encouraging results.

Analysis and modeling of a campus wireless network TCP/IP traffic

In this paper we analyzed and modeled wireless TCP/IP traffic. Specifically, we focused on the interarrival times of TCP flows and the number of packets within a flow. We show that the marginal distribution of the flow interarrival times is piecewise Weibull distributed. Second and higher order statistics show that the flow interarrival times are long-range dependent and exhibit multifractal scaling. Taking these higher order properties into consideration, we proposed a multinomial canonical cascade with 3 stages to model the flow interarrival times. Looking at the IP layer, we find that the number of packets in a flow is heavy-tailed distributed. Especially interesting is that in 2 of our data sets, the number of packets in a flow possesses infinite mean. The interarrival time of packets within a flow is highly correlated, bursty, and its statistical characteristics vary from flow to flow.

Peak flow inter-arrival times

The use of Erlang distribution for modelling inter-arrival times between flow peaks is proposed. Application to empirical data reveals that distributions so modelled change downstream, and that such modification can be accounted for by channel sinuosity and inflow.