Empirical assessment of VoIP overload detection tests

The control of communication networks critically relies on procedures capable of detecting unanticipated load changes. In this paper we explore such techniques, in a setting in which each connection consumes roughly the same amount of bandwidth (with VoIP as a leading example). We focus on large-deviations based techniques developed earlier in that monitor the number of connections present, and that issue an alarm when this number abruptly changes. The procedures proposed in are demonstrated by using real traces from an operational environment. Our experiments show that our detection procedure is capable of adequately identifying load changes

Changepoint detection for dependent Gaussian sequences

In this paper techniques are devised for detecting changepoints in Gaussian sequences, with the distinguishing feature that we do not impose the assumption that the series' terms be independent. For the specific case that the Gaussian sequence has a creation structure of ARMA type, we develop CUSUM-like procedures; we do so by relying on a large-deviations based approach. In the networking context, these tests can for instance be used to detect a change in traffic parameters, such as the mean, variance or correlation structure. The procedures are extensively validated by means of a broad set of simulation experiments

M/G/infinity transience, and its applications to overload detection

When controlling communication networks, it is of crucial importance to have procedures that are capable of checking whether there are unanticipated load changes. In this paper we develop techniques for detecting such load changes, in a setting in which each connection consumes roughly the same amount of bandwidth (with VoIP as a leading example). For the situation of exponential holding times an explicit analysis can be performed in a large-deviations regime, leading to approximations of the test statistic of interest (and, in addition, to results for the transient of the M/M/1 queue, which are of independent interest). This procedure being applicable to exponential holding times only, and also being numerically rather involved, we then develop an approximate procedure for general holding times. In this procedure we record the number of trunks occupied at equidistant points in time delta, 2 delta, . . ., where delta is chosen sufficiently large to safely assume that the samples are independent; this procedure is backed by results on the transient of the M/G/infinity queue, thus complementing earlier results on relaxation times. The validity of the testing procedures is demonstrated through an extensive set of numerical experiments

Tail asymptotics of the M/G/∞ model

This paper considers the so-called M/G/infinity model: jobs arrive according to a Poisson process with rate lambda, and each of them stays in the system during a random amount of time, distributed as a non-negative random variable B. With N(t) denoting the number of jobs in the system, the random process A(t) records the load imposed on the system in [0, t], i.e., A(t) := int_0^t N(s)ds. The main result concerns the tail asymptotics of A(t)/t: we find an explicit function f(·) such that f(t) ~ P(A(t)/t> rho*(1 + epsilon)), for t large; here rho := lambda EB. A crucial issue is that A(t) cannot be written as the sum of i.i.d. increments, which makes application of the classical Bahadur-Rao result impossible; instead an adaptation of this result is required. We compare the asymptotics found with the (known) asymptotics for rho large (and t fixed)

M/M/∞ transience, and its applications to overload detection

When controlling communication networks, it is of crucial importance to have procedures that are capable of checking whether there are unanticipated load changes. In this paper we develop techniques for detecting such load changes, in a setting in which each connection consumes roughly the same amount of bandwidth (with VoIP as a leading example). For the situation of exponential holding times an explicit analysis can be performed in a large-deviations regime, leading to approximations of the test statistic of interest (and, in addition, to results for the transient of the M/M/8 queue, which are of independent interest). Since this procedure is applicable to exponential holding times only, and is rather numerically involved, we develop an approximate procedure for general holding times. In this procedure we record the number of trunks occupied at equidistant points in time ¿,2¿,…, where ¿ is chosen sufficiently large to safely assume that the samples are independent; this procedure is backed by results on the transient of the M/G/8 queue, thus complementing earlier results on relaxation times. The validity of the testing procedures is demonstrated through an extensive set of numerical experiments

„Magyar református diákok nyugat-európai peregrinációja a XVII-XVIII. században — különös tekintettel az orvosi tanulmányokat is folytatókra“

DNS tunnels allow circumventing access and security policies in firewalled networks. Such a security breach can be misused for activities like free web browsing, but also for command & control traffic or cyber espionage, thus motivating the search for effective automated DNS tunnel detection techniques. In this paper we develop such a technique, based on the monitoring and analysis of network flows. Our methodology combines flow information with statistical methods for anomaly detection. The contribution of our paper is twofold. Firstly, based on flow-derived variables that we identified as indicative of DNS tunnelling activities, we identify and evaluate a set of non-parametrical statistical tests that are particularly useful in this context. Secondly, the efficacy of the resulting tests is demonstrated by extensive validation experiments in an operational environment, covering many different usage scenarios

Changepoint detection for dependent Gaussian sequences

In this paper techniques are devised for detecting changepoints in Gaussian sequences, with the distinguishing feature that we do not impose the assumption that the series' terms be independent. For the specific case that the Gaussian sequence has a creation structure of ARMA type, we develop CUSUM-like procedures; we do so by relying on a large-deviations based approach. In the networking context, these tests can for instance be used to detect a change in traffic parameters, such as the mean, variance or correlation structure. The procedures are extensively validated by means of a broad set of simulation experiments