Ryoichi Kawahara

Effect of sampling rate and monitoring granularity on anomaly detectability

In this paper, we quantitatively evaluate how sampling decreases the detectability of anomalous traffic. We build equations to calculate the false positive ratio (FPR) and false negative ratio (FNR) for given values of the sampling rate, statistics of normal traffic, and volume of anomalies to be detected. We show that by changing the measurement granularity, we can detect anomalies even with a low sampling rate and give the equation to derive optimal granularity by using the relationship between the mean and variance of aggregated flows. With those equations, we can answer for the practical questions that arise in actual network operations; what sampling rate to set in order to find the given volume of anomaly, or, if the sampling is too high for actual operation, then what granularity is optimal to find the anomaly for a given lower limit of sampling rate.

Traffic measurement and analysis in an ATM-based internet backbone

This paper reports our measurements and analysis of traffic characteristics in an Internet backbone ATM network. In order to utilize network resource efficiently while satisfying the quality of service requirement, it is important to understand the traffic characteristics. We therefore monitored the traffic from the flow or application level to the cell level on a link between NTTs Open Computer Network (OCN) and the Science Information Network (SINET), which are two of the largest Internet backbone ATM-based networks in Japan. Using the monitored traffic, we also evaluated the performance of the aggregate traffic by real-time simulation. Results show that the performance (cell loss ratio) greatly depended not only on link utilization but also on the number of flows, flow size, and traffic composition in terms of applications. We also found that the degree of self-similarity in the Internet backbone was not large. In addition, we clarified that more statistical multiplexing gain could be obtained in the Internet backbone when more flows were multiplexed onto a link.