Can multiscale traffic analysis be used to differentiate Internet applications

An accurate mapping of Internet traffic to applications can be important for a broad range of network management and measurement tasks, including traffic engineering, service differentiation, performance/failure monitoring and security. Traditional mapping approaches have become increasingly inaccurate because many applications use nondefault or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. In this paper we will demonstrate that multiscale traffic analysis based on multi-order wavelet spectrum can be used as a discriminator of Internet applications traffic profiles. By performing clustering analysis over the multiscale wavelet spectrum coefficients that are inferred from the measured traffic, the proposed methodology is able to efficiently differentiate different IP applications without using any payload information. This characteristic will allow the differentiation of traffic flows in unencrypted and encrypted scenarios. In order to compare the differentiating potential of different traffic application data, upload, download and joint upload and download flow statistics are considered to evaluate the identification approach for each selected protocol. Moreover, we also evaluate which timescales and spectrum orders are more relevant for the traffic differentiation. From the analysis of the obtained results we can conclude that the proposed methodology is able to achieve good identification results using asmall set of timescales of a single order wavelet spectrum of a general raw traffic statistic. © 2010 Springer Science+Business Media, LLC

Profiling de tráfego inter-operador baseado em análise multi-escalar

Mestrado em Engenharia Electrónica e TelecomunicaçõesO acesso à Internet nos últimos anos generalizou-se de tal forma que tornou-se um bem essencial no nosso dia-a-dia, seja para trabalho ou lazer. Contudo, esta rede global acarreta uma grande complexidade ao nível da gestão e monitorização de todas as suas ligações, tornando-se necessário assegurar qualidade-de-serviço (QdS) em toda a rede, de modo a garantir uma utilização eficaz por parte dos utilizadores particulares e empresariais. O aparecimento constante de novas aplicações introduziu a necessidade da implementação de protocolos de comunicação com diferentes requisitos, de acordo com a aplicação a que se destinam. Daí a necessidade de se mapear o tráfego na rede, associando-o à respetiva aplicação, de modo a se poder efetuar o profiling dos utilizadores da Internet. Esta dissertação surge motivada pela necessidade de identificar e caracterizar fluxos de dados ao nível da rede core, de modo que o seu mapeamento permita identificar os requisitos destes fluxos, otimizando a pré-alocação de recursos de rede. As dinâmicas de utilização de rede são identificadas recorrendo a análise multi-escalar do tráfego. Os objetivos desta dissertação consistem em identificar diferentes perfis de tráfego inter-operador, recorrendo a análise multi-escalar do tráfego e mostrando que é possível diferenciar fluxos de dados na rede core, associando-os a diferentes aplicações e identificando requisitos de recursos. Sabendo de antemão as necessidades de recursos das várias aplicações é possível ajustar os parâmetros de QdS das mesmas, permitindo aos operadores otimizar o desempenho da rede e do serviço.The access to Internet has widespread in the last few years in such a thriving way that it became something essential in our daily routine, both at work and leisure. However, the fact that it is a global network implies great complexity to administrate and control every single connection. Therefore, it’s necessary to ensure quality-of-service (QoS) across the entire network, in order to guarantee an effective utilization from individual and business users. The continued appearance of new applications introduced the need for the implementation of communication protocols with different requirements, according with the respective application. Hence the need to map the traffic in the network, associating it with the respective application, in order to perform the profiling of Internet users. This dissertation is motivated by the need to identify and characterize data flows in the core network, so that their mapping can help identify requirements of these flows, optimizing the pre-allocation of network resources. The network utilization dynamics are identified resorting to multiscale traffic analysis. The objectives of this dissertation consist in identifying different traffic profiles with multiscale traffic analysis and showing that is possible to differentiate data flows in the core network, associating them to different applications and identifying requirements of resources. Knowing beforehand the resource requirements of various applications, it’s possible to improve their QoS parameters, allowing the providers to optimize the performance of both network and service