Kyoungwon Suh

Characteristics of YouTube network traffic at a campus network - Measurements, models, and implications

User-Generated Content has become very popular since new web services such as YouTube allow for the distribution of user-produced media content. YouTube-like services are different from existing traditional VoD services in that the service provider has only limited control over the creation of new content. We analyze how content distribution in YouTube is realized and then conduct a measurement study of YouTube traffic in a large university campus network. Based on these measurements, we analyzed the duration and the data rate of streaming sessions, the popularity of videos, and access patterns for video clips from the clients in the campus network. The analysis of the traffic shows that trace statistics are relatively stable over short-term periods while long-term trends can be observed. We demonstrate how synthetic traces can be generated from the measured traces and show how these synthetic traces can be used as inputs to trace-driven simulations. We also analyze the benefits of alternative distribution infrastructures to improve the performance of a YouTube-like VoD service. The results of these simulations show that P2P-based distribution and proxy caching can reduce network traffic significantly and allow for faster access to video clips.

Push-to-Peer Video-on-Demand System: Design and Evaluation

We propose Push-to-Peer, a peer-to-peer system to cooperatively stream video. The main departure from previous work is that content is proactively pushed to peers, and persistently stored before the actual peer-to-peer transfers. The initial content placement increases content availability and improves the use of peer uplink bandwidth. Our specific contributions are: (i) content placement and associated pull policies that allow the optimal use of uplink bandwidth; (ii) performance analysis of such policies in controlled environments such as DSL networks under ISP control; (iii) a distributed load balancing strategy for selection of serving peers.

Watch global, cache local: YouTube network traffic at a campus network: measurements and implications

Web services such as YouTube which allow the distribution of user-produced media have recently become very popular. YouTube-like services are different from existing traditional VoD services because the service provider has only limited control over the creation of new content. We analyze how the content distribution in YouTube is realized and then conduct a measurement study of YouTube traffic in a large university campus network. The analysis of the traffic shows that: (1) No strong correlation is observed between global and local popularity; (2) neither time scale nor user population has an impact on the local popularity distribution; (3) video clips of local interest have a high local popularity. Using our measurement data to drive trace-driven simulations, we also demonstrate the implications of alternative distribution infrastructures on the performance of a YouTube-like VoD service. The results of these simulations show that client-based local caching, P2P-based distribution, and proxy caching can reduce network traffic significantly and allow faster access to video clips.

Locating network monitors: complexity, heuristics, and coverage

There is increasing interest in concurrent passive monitoring of IP flows at multiple locations within an IP network. The common objective of such a distributed monitoring system is to sample packets belonging to a large fraction of IP flows in a cost-effective manner by carefully placing monitors and controlling their sampling rates. In this paper, we consider the problem of where to place monitors within the network and how to control their sampling. To address the tradeoff between monitoring cost and monitoring coverage, we consider minimum cost and maximum coverage problems under various budget constraints. We show that all of the defined problems are NP-hard. We propose greedy heuristics, and show that the heuristics provide solutions quite close to the optimal solutions through experiments using synthetic and real network topologies. In addition, our experiments show that a small number of monitors is often enough to monitor most of the traffic in an entire IP network.

Passive online rogue access point detection using sequential hypothesis testing with TCP ACK-pairs

Rogue (unauthorized) wireless access points pose serious security threats to local networks. In this paper, we propose two online algorithms to detect rogue access points using sequential hypothesis tests applied to packet-header data collected passively at a monitoring point. One algorithm requires training sets, while the other does not. Both algorithms extend our earlier TCP ACK-pair technique to differentiate wired and wireless LAN TCP traffic, and exploit the fundamental properties of the 802.11 CSMA/CA MAC protocol and the half duplex nature of wireless channels. Our algorithms make prompt decisions as TCP ACK-pairs are observed, and only incur minimum computation and storage overhead. We have built a system for online rogue-access-point detection using these algorithms and deployed it at a university gateway router. Extensive experiments in various scenarios have demonstrated the excellent performance of our approach: the algorithm that requires training provides rapid detection and is extremely accurate (the detection is mostly within 10 seconds, with very low false positive and false negative ratios); the algorithm that does not require training detects 60%-76% of the wireless hosts without any false positives; both algorithms are light-weight (with computation and storage overhead well within the capability of commodity equipment).

Characterizing and Detecting Skype-Relayed Traffic

Networked application developers have recently started to use end-users’ computers as relay nodes – application instances that also act as bridges between pairs of hosts running the same application. Relay nodes can bring costs to both users and network operators, at least in terms of increased bandwidth consumption. An interesting problem is to characterize the nature of relayed traffic and to detect its presence in the network. This paper focuses on characterizing and detecting relayed traffic generated by Skype, a popular voice over IP application that uses relays. Our technique relies solely on flow-level properties rather than on applicationor protocol-specific information. Using two different controlled experimental environments we generate and collect a large amount of Skype-relayed traffic. We propose several metrics to characterize the nature of relayed traffic. These metrics together with the results obtained from the experimental characterization of Skype-relayed traffic are used to detect Skyperelayed traffic traversing the access point of a large network. We show that the metrics proposed can be used to reliably detect Skype-relayed traffic. Finally, we believe the metrics proposed could be applied more broadly in the detection of relayed traffic generated by other multimedia applications.

Identifying 802.11 traffic from passive measurements using iterative Bayesian inference

In this paper, we propose a classification scheme that differentiates Ethernet and WLAN TCP flows based on measurements collected passively at the edge of a network. This scheme computes two quantities, the fraction of wireless TCP flows and the degree of belief that a TCP flow traverses a WLAN inside the network, using an iterative Bayesian inference algorithm that we developed. We prove that this iterative Bayesian inference algorithm converges to the unique maximum likelihood estimate (MLE) of these two quantities. Furthermore, it has the advantage that it can handle any general K-classification problem given the marginal distributions of these classes. Numerical and experimental evaluations demonstrate that our classification scheme obtains accurate results. We apply this scheme to two sets of traces collected from two campus networks: one set collected from UMass in mid 2005 and the other collected from UConn in late 2010. Our technique infers that 4%-7% and 52%-55% of incoming TCP flows traverse an IEEE 802.11 wireless link in these two networks, respectively.

Network performance of smart mobile handhelds in a university campus WiFi network

Smart mobile handheld devices (MHDs) such as smartphones have been used for a wide range of applications. Despite the recent flurry of research on various aspects of smart MHDs, little is known about their network performance in WiFi networks. In this paper, we measure the network performance of smart MHDs inside a university campus WiFi network, and identify the dominant factors that affect the network performance. Specifically, we analyze 2.9TB of data collected over three days by a monitor that is located at a gateway router of the network, and make the following findings: (1) Compared to non-handheld devices (NHDs), MHDs use well provisioned Akamai and Google servers more heavily, which boosts the overall network performance of MHDs. Furthermore, MHD flows, particularly short flows, benefit from the large initial congestion window that has been adopted by Akamai and Google servers. (2) MHDs tend to have larger local delays inside the WiFi network and are more adversely affected by the number of concurrent flows. (3) Earlier versions of Android OS (before 4.X) cannot take advantage of the large initial congestion window adopted by many servers. On the other hand, the large receive window adopted by iOS is not fully utilized by most flows, potentially leading to waste of resources. (4) Some application-level protocols cause inefficient use of network and operating system resources of MHDs in WiFi networks. Our observations provide valuable insights on content distribution, server provisioning, MHD system design, and application-level protocol design.

Challenges in peer-to-peer gaming

While multi-player online games are very successful, their fast deployment suffers from their server-based architecture. Indeed, servers both limit the scalability of the games and increase deployment costs. However, they make it easier to control the game (e.g. by preventing cheating and providing support for billing). Peer-to-peer, i.e. transfer of the game functions on each each players machine, is an attractive communication model for online gaming. We investigate here the challenges of peer-to-peer gaming, hoping that this discussion will generate a broader interest in the research community.

P2Cast: peer-to-peer patching for video on demand service

Providing video on demand (VoD) service over the Internet in a scalable way is a challenging problem. In this paper, we propose P2Cast—an architecture that uses a peer-to-peer approach to cooperatively stream video using patching techniques, while only relying on unicast connections among peers. We address the following two key technical issues in P2Cast: (1) constructing an application overlay appropriate for streaming; and (2) providing continuous stream playback (without glitches) in the face of disruption from an early departing client. Our simulation experiments show that P2Cast can serve many more clients than traditional client-server unicast service, and that it generally out-performs multicast-based patching if clients can cache more than 10% of a stream’s initial portion. We handle disruptions by delaying the start of playback and applying the shifted forwarding technique. The threshold in P2Cast, i.e., the length of time during which arriving clients form a single session, can serve as a “knob” to adjust the balance between the scalability and the clients’ viewing quality.