António Pacheco

Multiscale Fitting Procedure Using Markov Modulated Poisson Processes

This paper proposes a parameter fitting procedure using Markov Modulated Poisson Processes (MMPPs) that leads to accurate estimates of queuing behavior for network traffic exhibiting long-range dependence behavior. The procedure matches both the autocovariance and marginal distribution of the counting process. A major feature is that the number of states is not fixed a priori, and can be adapted to the particular trace being modeled. The MMPP is constructed as a superposition of L 2-MMPPs and one M-MMPP. The 2-MMPPs are designed to match the autocovariance and the M-MMPP to match the marginal distribution. Each 2-MMPP models a specific time-scale of the data. The procedure starts by approximating the autocovariance by a weighted sum of exponential functions that model the autocovariance of the 2-MMPPs. The autocovariance tail can be adjusted to capture the long-range dependence characteristics of the traffic, up to the time-scales of interest to the system under study. The procedure then fits the M-MMPP parameters in order to match the marginal distribution, within the constraints imposed by the autocovariance matching. The number of states is also determined as part of this step. The final MMPP with M2L states is obtained by superposing the L 2-MMPPs and the M-MMPP. We apply the inference procedure to traffic traces exhibiting long-range dependence and evaluate its queuing behavior through simulation. Very good results are obtained, both in terms of queuing behavior and number of states, for the traces used, which include the well-known Bellcore traces.

Modeling IP traffic: joint characterization of packet arrivals and packet sizes using BMAPs

This paper proposes a traffic model and a parameter fitting procedure that are capable of achieving accurate prediction of the queuing behavior for IP traffic exhibiting long-range dependence. The modeling process is a discrete-time batch Markovian arrival process (dBMAP) that jointly characterizes the packet arrival process and the packet size distribution. In the proposed dBMAP, packet arrivals occur according to a discrete-time Markov modulated Poisson process (dMMPP) and each arrival is characterized by a packet size with a general distribution that may depend on the phase of the dMMPP. The fitting procedure is designed to provide a close match of both the autocovariance and the marginal distribution of the packet arrival process, using a dMMPP; a packet size distribution is fitted individually to each state of the dMMPP. A major feature of the procedure is that the number of states of the fitted dBMAP is not fixed a priori; it is determined as part of the procedure itself. In this way, the procedure allows establishing a compromise between the accuracy of the fitting and the number of parameters, while maintaining a low computational complexity.We apply the inference procedure to several traffic traces exhibiting long-range dependence. Very good results were obtained since the fitted dBMAPs match closely the autocovariance, the marginal distribution and the queuing behavior of the measured traces. Our results also show that ignoring the packet size distribution and its correlation with the packet arrival process can lead to large errors in terms of queuing behavior.

Probabilistic Situation Calculus

In this article we propose a Probabilistic Situation Calculus logical language to represent and reason with knowledge about dynamic worlds in which actions have uncertain effects. Uncertain effects are modeled by dividing an action into two subparts: a deterministic (agent produced) input and a probabilistic reaction (produced by nature). We assume that the probabilities of the reactions have known distributions.Our logical language is an extension to Situation Calculae in the style proposed by Raymond Reiter. There are three aspects to this work. First, we extend the language in order to accommodate the necessary distinctions (e.g., the separation of actions into inputs and reactions). Second, we develop the notion of Randomly Reactive Automata in order to specify the semantics of our Probabilistic Situation Calculus. Finally, we develop a reasoning system in MATHEMATICA capable of performing temporal projection in the Probabilistic Situation Calculus.

Model checking expected time and expected reward formulae with random time bounds

In this paper, we extend CSL (continuous stochastic logic) with an expected time and an expected reward operator, both of which are parameterized by a random terminal time. With the help of such operators we can state, for example, that the expected sojourn time in a set of goal states within some generally distributed delay is at most (at least) some time threshold. In addition, certain performance measures of systems which contain general distributions can be calculated with the aid of this extended logic. We extend the efficient model checking of CTMCs against the logic CSL developed by Katoen et al. [1] to cater for the new operator. Our method involves precomputing a family of mixed Poisson expected sojourn time coefficients for a range of random variables which includes Pareto, uniform and gamma distributions, but otherwise carries the same computational cost as calculating CSL until formulae.

Robust feature selection and robust PCA for internet traffic anomaly detection

Robust statistics is a branch of statistics which includes statistical methods capable of dealing adequately with the presence of outliers. In this paper, we propose an anomaly detection method that combines a feature selection algorithm and an outlier detection method, which makes extensive use of robust statistics. Feature selection is based on a mutual information metric for which we have developed a robust estimator; it also includes a novel and automatic procedure for determining the number of relevant features. Outlier detection is based on robust Principal Component Analysis (PCA) which, opposite to classical PCA, is not sensitive to outliers and precludes the necessity of training using a reliably labeled dataset, a strong advantage from the operational point of view. To evaluate our method we designed a network scenario capable of producing a perfect ground-truth under real (but controlled) traffic conditions. Results show the significant improvements of our method over the corresponding classical ones. Moreover, despite being a largely overlooked issue in the context of anomaly detection, feature selection is found to be an important preprocessing step, allowing adaption to different network conditions and inducing significant performance gains.

On the performance of combined EWMA schemes for μ and σ : A Markovian approach

Changes in the process mean (μ) or in the process standard deviation (σ) ought to be regarded as an indication that a production process is out of control. This paper considers the problem of the joint monitoring of these two parameters — when the quality characteristic follows a normal distribution —, using a combined Exponentially Weighted Moving Average (CEWMA) scheme. Three performance measures of this joint control scheme are investigated under shifts in the process mean or inflations of the process standard deviation, and under the adoption of head starts: the average run length, the run length percentage points and the probability of a misleading signal. Approximations to these three performance indicators will be obtained considering a two-dimensional Markov chain. The independence between the horizontal and vertical transitions of this approximating two-dimensional Markov chain plays an important role in providing simple expressions to those performance measures which avoid the computation of a probability transition matrix with unusual dimensions. A numerical comparison between these three performance measures and the corresponding ones of the matched combined Shewhart (CShewhart) scheme will be also presented, leading to the conclusion that the substituition of this combined scheme by the CEWMA scheme can improve the joint monitoring of the process mean and standard deviation.

Classification of Internet users using discriminant analysis and neural networks

The (reliable) classification of Internet users, based on their hourly traffic profile, can be advantageous in several traffic engineering tasks and in the selection of suitable tariffing plans. For example, it can be used to optimize the routing by mixing users with contrasting hourly traffic profiles in the same network resources or to advise users on the tariffing plan that best suits their needs. In this paper we compare the use of discriminant analysis and artificial neural networks for the classification of Internet users. The classification is based on a partition obtained by cluster analysis. We classify the Internet users based on a data set measured at the access network of a Portuguese ISP. Using cluster analysis performed over half of the users (randomly chosen) we have identified three groups of users with similar behavior. The classification methods were applied to the second half of users and the obtained classification results compared with those of cluster analysis performed over the complete set of users. Our findings indicate both discriminant analysis and neural networks are valuable classification procedures, with the former slightly outperforming the latter, for the specific scenario under analysis.

Misleading Signals in Simultaneous Residual Schemes for the Mean and Variance of a Stationary Process

The performance assessment of simultaneous surveillance schemes for the process mean (μ) and variance (σ2) requires a special performance measure, in addition to the average run length. It refers to two events which can be likely to happen when such schemes are at use: the individual chart for μ triggers a signal before the one for σ2, even though the process mean is on-target and the variance is off-target; the constituent chart for σ2 triggers a signal before the one for μ, although the variance is in-control and the process mean is out-of-control. These are called misleading signals since they correspond to a misinterpretation of a mean (variance) change as a shift in the process variance (mean) and can lead the quality control operator or engineer to a misdiagnosis of assignable causes and to deploy incorrect actions to bring the process back to target. This article discusses the impact of autocorrelation on the probability of misleading signals of simultaneous Shewhart and EWMA residual schemes for the mean and variance of a stationary process.

Markov-Modulated Processes and Semiregenerative Phenomena

Foundations of Markov Random Walks and Markov Additive Processes: Theory of Semiregenerative Phenomena Markov Random Walk-Fluctuation Theory and Wiener-Hopf Factorization Further Results for Semiregenerative Phenomena Limits Theorems for Markov Random Walks Markov Renewal and Markov-Additive Processes -- A Review and Some New Results Markov-Additive Processes of Arrivals Application Examples: Markov-Modulated Single-Server Queueing Systems A Storage Model for Data Communications Systems A Markovian Storage Model.

Analytically explicit results for the gi/c-msp/1/∞ queueing system using roots

In this paper, we present (in terms of roots) a simple closed-form analysis for evaluating system-length distribution at prearrival epochs of the GI/C-MSP/1 queue. The proposed analysis is based on roots of the associated characteristic equation of the vector-generating function of system-length distribution. We also provide the steady-state system-length distribution at an arbitrary epoch by using the classical argument based on Markov renewal theory. The sojourn-time distribution has also been investigated. The prearrival epoch probabilities have been obtained using the method of roots which is an alternative approach to the matrix-geometric method and the spectral method. Numerical aspects have been tested for a variety of arrival-and service-time distributions and a sample of numerical outputs is presented. The proposed method not only gives an alternative solution to the existing methods, but it is also analytically simple, easy to implement, and computationally efficient. It is hoped that the results obtained will prove beneficial to both theoreticians and practitioners.