Felipe Mata

High-Performance network traffic processing systems using commodity hardware

The Internet has opened new avenues for information accessing and sharing in a variety of media formats. Such popularity has resulted in an increase of the amount of resources consumed in backbone links, whose capacities have witnessed numerous upgrades to cope with the ever-increasing demand for bandwidth. Consequently, network traffic processing at todays data transmission rates is a very demanding task, which has been traditionally accomplished by means of specialized hardware tailored to specific tasks. However, such approaches lack either of flexibility or extensibility--or both. As an alternative, the research community has pointed to the utilization of commodity hardware, which may provide flexible and extensible cost-aware solutions, ergo entailing large reductions of the operational and capital expenditure investments. In this chapter, we provide a survey-like introduction to high-performance network traffic processing using commodity hardware. We present the required background to understand the different solutions proposed in the literature to achieve high-speed lossless packet capture, which are reviewed and compared.

Detection of traffic changes in large-scale backbone networks: The case of the Spanish academic network

Network management systems produce a huge amount of data in large-scale networks. For example, the Spanish academic network features hundreds of access and backbone links, each of which produces a link utilization time series. For the purpose of detecting relevant changes in traffic load a visual inspection of all such time series is required. As a result, the operational expenditure increases. In this paper, we present an on-line change detection algorithm to identify the relevant change points in link utilization, which are presented to the network manager through a graphical user interface. Consequently, the network manager only inspects those links that show a stationary and statistically significant change in the link load.

Automated Detection of Load Changes in Large-Scale Networks

This paper presents a new online algorithm for automated detection of load changes, which provides statistical evidence of stationary changes in traffic load. To this end, we perform continuous measurements of the link load, then look for clusters in the dataset and finally apply the Behrens-Fisher hypothesis testing methodology. The algorithm serves to identify which links deviate from the typical load behavior. The rest of the links are considered normal and no intervention of the network manager is required. Due to the automated selection of abnormal links, the Operations Expenditure (OPEX) is reduced. The algorithm has been applied to a set of links in the Spanish National Research and Education Network (RedIRIS) showing good results.

Anomaly detection in diurnal data

In this paper we present methodological advances in anomaly detection tailored to discover abnormal traffic patterns under the presence of seasonal trends in data. In our setup we impose specific assumptions on the traffic type and nature; our study features VoIP call counts, for which several traces of real data has been used in this study, but the methodology can be applied to any data following, at least roughly, a non-homogeneous Poisson process (think of highly aggregated traffic flows). A performance study of the proposed methods, covering situations in which the assumptions are fulfilled as well as violated, shows good results in great generality. Finally, a real data example is included showing how the system could be implemented in practice.

Factor analysis of Internet traffic destinations from similar source networks

Purpose – This study aims to assess whether similar user populations in the Internet produce similar geographical traffic destination patterns on a per‐country basis.Design/methodology/approach – The authors collected a country‐wide NetFlow trace, which encompasses the whole Spanish academic network. Such a trace comprises several similar campus networks in terms of population size and structure. To compare their behaviors, the authors propose a mixture model, which is primarily based on the Zipf‐Mandelbrot power law to capture the heavy‐tailed nature of the per‐country traffic distribution. Then, factor analysis is performed to understand the relation between the response variable, number of bytes or packets per day, with dependent variables such as the source IP network, traffic direction, and country.Findings – Surprisingly, the results show that the geographical distribution is strongly dependent on the source IP network. Furthermore, even though there are thousands of users in a typical campus networ...

On the real impact of Path Inflation in networks under production

The research community has proved the existence and studied the root causes of Path Inflation on the Internet - end-to-end paths significantly longer than necessary. However, it has been typically ignored that the popularity of traffic destinations and, consequently, of network paths, is clearly heterogeneous - some destinations are popular while others are barely accessed. In this paper, we propose a trace-driven methodology to measure the Path Inflation accounting for the popularity of Internet destinations from a given network, thus evaluating the implications that Path Inflation exerts on real networks under production. This information is important for network operators because it allows them to objectively stand out those destinations whose connection analysis must be prioritized. The results of applying this methodology to the Spanish academic network show that the most critical regions to focus on are Spains closest countries, which either are very popular or have large Path Inflation as a consequence of the use of transatlantic links as intermediate nodes, or both.

Traffic monitoring for assuring quality of advanced services in future internet

Services based on packet switched networks are becoming dominant in telecommunication business and both operators and service providers must evolve in order to guarantee the required quality. Increasing bandwidth is no longer a viable solution because of the business erosion for network operators which cannot expect revenues due to the large investments required to satisfy new applications demand of bandwidth. This paper presents devices and a specific architecture of services monitoring platform that allows network operators and service providers to analyze the perceived quality of service and check their service level agreements. Thus, a cost-effective service management, based on direct IP traffic measuring, can be supported on integrated monitoring systems to provide network-centric mechanisms for differentiated quality of service, security and other advanced services.

Multivariate fairly normal traffic model for aggregate load in large-scale data networks

Traffic models are crucial for network planning, design, performance evaluation and optimization. However, it is first necessary to assess the validity of the newly proposed models. In this paper we present the validation of a multivariate fairly normal model for aggregate traffic that exploits the well-known day-night traffic pattern, which was first assumed and applied in a former work to detect changes in the Internet links’ load on-line. The validation process entails several normality analytical and graphical tests which are applied to real network traffic measurements, on attempts to assess fairly normality both in the marginal and joint distributions of the multivariate model. The results of the normality tests provide evidence that our design is adequate to model aggregate traffic accurately capturing the day-night traffic pattern.

Performance evaluation of an online load change detection algorithm

In this paper we evaluate an online load change detection algorithm, aimed to identify changes in traffic loads when monitoring Internet links. This online change detector was first introduced in [1] and produces an alert when a sustained and statistically significant change has been detected. Then, the network manager verifies the change and takes action if the change is truly relevant. We show that the behavior of the algorithm with synthetically generated time series is appropriate, and the obtained results are as expected.