Matching Multi-Fractal Process Parameters Against Real Data Traffic

(1)

Data Trac

Patrik Carlsson 1

, Markus Fiedler 2

and Arne A. Nilsson 3

1

BlekingeInstituteofTechnology,37179Karlskrona,Sweden. E-mail: Patrik.Carlsson@bth.se

2

BlekingeInstituteofTechnology,37179Karlskrona,Sweden. E-mail: Markus.Fiedler@bth.se

3

BlekingeInstituteofTechnology,37179Karlskrona,Sweden. E-mail: Arne.Nilsson@bth.se

Abstract

Recentanalyses of realdata/internet trac indicate

that data trac exhibits long-range dependence as

wellasself-similarormulti-fractalproperties. Byus-

ingmathematicalmodelsofInternettracthatshare

thesepropertieswecanperformanalyticalstudiesof

networktrac. Thisgivesusanopportunitytoanal-

ysepotentialbottlenecks and estimate delays in the

networks.

Processeswithmulti-fractalpropertiescanbemod-

eledbymultiplyingtheoutputofMarkovModulated

RateProcesses(MMRP) [1]eachdened byfour pa-

rameters. The MMRP are easily used in stochastic

uid ow modeling. This model is also suited for

analysis of other trac types e.g. VoIP and thus,

itallowsforintegration of dierent trac types,i.e.

time-sensitivevoicetrac with best-eort data traf-

c. Using this model we can calculate performance

parametersforeachindividualstreamthatentersthe

system/model.

In this paper we show how to construct amulti-

fractalprocessthatismatchedtomeasureddatafrom

MMRPsub processes.

Keywords: Multi-fractal trac, uid ow model,

numericalanalysis,performanceevaluation

1 Introduction

Thereasonforthisresearchisthatwewanttodevelop

a mathematical model for Internet trac, that can

be usedin auid owanalysis. Inearlierpapers[1]

and [2] we demonstrated that the uid ow model

is a usable tool for analytical performance studies.

We have used data processes that had multi-fractal

properties (MFP), and we also expressed desires to

dosimilarstudies basedonprocessesthathavebeen

modeled based on measurednetwork trac. In this

paper we show how a certain class of multi-fractal

processes can be modeled such that they match up

well against real network trac. The tool we now

have permits us to do better capacity management

insteadoftoday'srule-of-thumb.

Sincewearetomatchamathematicalmodelagainst

measureddata,wewillstartbydescribingthemathe-

maticalmodelanditsbasicproperties. Followingthat

wewillverifythismodelagainstsimulationsthathave

beenperformed. The actualmatching oftheparam-

eters basedon real measuredtrac will then be de-

scribed,andnally someconclusionswill bedrawn.

2 Processes description

The mathematical model that is used to generate a

processwithmulti-fractalpropertiesisformedbymul-

tiplying the output of independent 2-state Markov

modulatedrateprocesses(calledsub-processes). The

processwillbeformedas

R (t)= n 1

Y

i=0 R

i

(t) (1)

Here R

i

(t) is the output rate from sub-process i at

time t (data-unit/time-unit). The 2-state Markov-

modulated rateprocessisdepictedin Figure1. This

isawellknownandoftenusedmodel. Themodelwas

originallysuggestedin[4]

2.1 Description of a Sub-Process

Eachsub processisasimplelow-highprocess,asde-

scribedinFigure1. Thesubprocessestransitionma-

trixandratematrixareformedas

M

i

=

i

R

i

=

l

i 0

0 h

i

(2)

ThersttwomomentsoftheMFP rateprocessis

goingtobeusedforthematchingofprocessestoMFP.

Thusitisinterestingtohaveanalyticalexpressionsfor

thetworstmoments.

E[R

i (t)]=

l

i

i +h

i

+

(3)

(2)

low

high -

i

ow 6

rate

h

i

l

i

Figure 1: 2-state Markov Modulated Rate Process,

thei:thasub-process

E

R 2

i (t)

= 2

i

i (l

i h

i )

2

t 2

(

i +

i )

3

t 1

i +

e (

i +

i )t

i +

i

+ (l

i

i +h

i

i )

2

(

i +

i )

2

(4)

A more detailed derivation can be found in [3]. It

is obvious that the equation for the rst moment is

notaectedbyanychangesint. Thesecond-moment

however

lim

t!0 E

R 2

i (t)

=

i

i (l

i h

i )

2

(i+i) 2

+E

R 1

i (t)

2

(5)

lim

t!1 E

R 2

i (t)

= (l

i

i +h

i

i )

2

(i+i) 2

=E

R 1

i (t)

2

(6)

E[R_i²(t)]

E[Ri 1(t)]

10⁻³t t 10³t ∞

0

Time scales Second Moment

Figure 2: Typical shape of the second moment of a

subprocess.

i

=

i

andE[R

i (t)]=1

2.2 Process

Asmentionedbefore theprocessis formed bymulti-

plying theoutputfrom thesub-processes. Thetran-

sitionmatrixisformedusingKroneckeraddition:

M =M M M (7)

R

D

=R

0 R

1

R

n 1

: (8)

Where

AB= AI

B +I

A

B (9)

AB= AI

B

I

A

B (10)

and I

x

is adiagonal matrixwith ones on it and the

samesize asmatrixx,where isdened as

A= 2

4 a

1;1

::: a

1;m

::: ::: :::

a

n;1

::: a

n;m 3

5

nm

B= 2

4 b

1;1

::: b

1;q

::: ::: :::

b

n;1

::: b

p;q 3

5

pq

AB= 2

6

4 a

1;1

B ::: a

1;m B

.

. .

.

. .

.

a

n;1

B ::: a

n;m B

3

7

5

npmq

(11)

Themoments for theprocess are easily obtained

simplybymultiplicationofthesub-processmoments

E[R (t)]= Q

n 1

i=0 E

R 1

i (t)

(12)

E

R 2

(t)

= Q

n 1

i=0 E

R 2

i (t)

(13)

3 Simulations

To compare the analytical formulas of the rst and

secondmoments,somesimulationshavebeenrun. In

Figure3asetofsimulationsareshownwherewecom-

pareresultsfromsimulationwithresultfromthean-

alytical method. In Table 1 the process parameters

are presented. In Figure 3 the rst and the second

momentareshown. Eachrowcorrespondstoagiven

set ofparameters,startingwith1. Thecolumns cor-

respondstothemoments,columnoneistherstmo-

mentandcolumntwothesecondmoment.

Looking at the rst row thematch is perfect for

bothmoments. Howeverthis process correspondsto

a non varying process, with l

i

= h

i

= 2 hence no

variations. Looking at row two and three, a slight

dierence isdetected. It canprobablybeaccredited

to atoosmall sample space forthe simulation. But

thematchisfairlygoodatleastathighertimescales

forthesecondmoment.

4 Matching

Our developed matching method assumes that the

rstmomenthasbeennormalizedinsuchawaythat

(3)

10⁰ 10⁵ 0

1 2 3

First Moment

10⁰ 10⁵

1 2 3 4 5

Second Moment

10⁰ 10⁵

0 1 2 3

10⁰ 10⁵

1 2 3 4 5

10⁰ 10⁵

0 1 2 3

10⁰ 10⁵

1 2 3 4 5

Simulated Analytical

Figure3: Acomparisonbetweenmomentsthatwhere

calculated from simulations and moments based on

theanalyticalformulasinEquation3and4

ID l

i h

i

Mean

1 100 0.02 0.02 2 2 2

2 100 0.02 0.02 1 2 1.5

3 83.333 0.03 0.02 1 2 1.4

Table1: Parameters usedinsimulation

themeanoftherstmomentsatdierenttimescales

willbe1.

Whenmatching real-worlddatathere areusually

sometrade-osto bemade. Wehavechosentoover-

estimate the moments. The main reason for this is

thatitisbettertoworkagainstaworstcasescenario.

Anotherconsiderationisthenumberofprocessesthat

areusedtomatchtheprocess,sinceinananalysisstep

tofollow[1]thereisaupper-boundontheprocessing

power. That is if weuse an innite numberof pro-

cesses we would probably get a good match, but it

wouldnotbeusableinfuture work.

When matching weare trying to match therst

twomoments. There are anumber of methods that

couldbeusedtodothis. Inthispaperwehavechosen

to use asimple and heuristic method. The method

worksroughlylikethis:

1. Initialize

~

D 2

Thesecondmoment

~

D 1

Therstmoment

~

T Thetimescales

whereD x

i

denotesthei:thelementinthevector

E[Ri 2(t)]

E[R_i¹(t)]

10⁻¹t t 10¹t

Desired i:th process

0 ∞

Time scales Second Moment

Figure 4: How sub-process i is identied from the

desiredsignal

2. For each time scale in

~

T, try to nd a sub-

processthat haspropertiesthatmatchit. Asif

theprocesswereconstant attimescalessmaller

thant. Cf. Figure4.

3. Loop through

~

T starting at the largest time

scale and going down to the smallest, where i

denotesthepositionofthecurrenttimescalein

~

T.

(a) Sett=T

i

, isestimated tobe10t

M 2

=D 2

i M

1

=D 1

i

(14)

These will beused asthedesiredvalue of

the sub-process as t ! 0, since the pro-

cesshasbeennormalizedinsuchamanner

that themean will beoneand remember-

ingthatthelimitvalueofasub-processin

equation5. Thisvaluecanbetoolargefor

onesinglesub-process. Thesolutionisthe

usage ofsub-sub-processes,processesthat

are identical and together achievethe de-

siredpropertiesonagiventimescale.

(b) Estimatehowmanysub-sub-processesthat

areneededtoachievethislimit.

k= l

logM 2

log2 m

(15)

(c) If k <0 thenthis time scale isO.K.goto

3.

(d) Determinethelimitforasub-sub-process

O 2

= k p

M 2

O 1

= k p

M 1

(16)

(e) Basedonthesymmetryfrom==2=

an expressionfor landhcanbeobtained

(4)

inthefollowingmanner:

L= 2 p

O 2

(O 1

) 2

(17)

l= M

1

i

L

2

(18)

h= M

1

i +

L

2

(19)

(f) The parameters that identify sub-process

i are known (the output rates in the two

states, the transition rates and the num-

berofsub-sub-processesthatformthesub-

process). Create twovectors

~

M 2

i and

~

M 1

i

thatspanalltimescalesdenedby

~

T from

these parameters. These vectors specify

the moments for sub-process i. Store the

parametersneededtocreatethesevectors.

(g) Remove the inuence on the desired pro-

cess that this sub-process has by simply

dividing it out, element-by-element. j is

thesizeofthe

~

T.

~

D 1

= h

D 1

1

M 1

1

; :::; D

1

j

M 1

j i

(20)

~

D 2

= h

D 2

1

M 2

1

; :::; D

2

j

M 2

j i

(21)

4. Now the matched process can be created by

combining the sub-processesusing element-by-

elementmultiplication using Equation 3and 4

from the stored parameters. Recreate themo-

mentvectorsforeachsub-processcallthem

~

P x

i

where i indicate that this is sub-process i and

x indicate thex:thmoment (one ortwo). The

momentswillthenbe

~

M 1

= 2

6

4 P

1

1;1

P 1

2;1 :::P

1

j;1

;

:::;

P 1

1;n 1

P 1

2;n 1 :::P

1

j;n 1 3

7

5 (22)

~

M 2

= 2

6

4 P

2

1;1

P 2

2;1 :::P

2

j;1

;

:::;

P 2

1;n 1

P 2

2;n 1 :::P

2

j;n 1 3

7

5 (23)

5. Repeat step3as many timesasdesired (could

bebasedonmaximalerrorormaximalnumber

ofprocesses).

Now itis possibleto listtheparametersthat are

neededto matchthedesiredinput. Whencomparing

amatchedprocesswithameasuredprocesswedene

theerroras

!

Error=

"

D

2

1 M

2

1

D 2

1

; ::: ;

D

2

j M

2

j

D 2

j

#

(24)

4.1 Example 1: Simulated data

InFigure5anexampleofthematchingisshown. Here

i i

1 512 512 0.5 1.5

2 128 128 0.5 1.5

3 32 32 0.5 1.5

4 8 8 0.5 1.5

5 2 2 0.5 1.5

Table2: Parametersusedtocreatethedesiredsignal

thatis matchedinExample1.

byvesub-processeslistedin Table2. Therstmo-

ment is aperfect match, the second moment is over

estimated. Looking at theerror the overestimation

isnotthatlarge.

10⁻⁵ 10⁻⁴ 10⁻³ 10⁻² 10⁻¹ 10⁰ 10¹ 10² 10³

0.9 0.95 1 1.05 1.1

First Moment

Measured Matched

10⁻⁴ 10⁻³ 10⁻² 10⁻¹ 10⁰ 10¹ 10² 10³

1.5 2 2.5 3

Second Moment

Measured Matched

10⁻⁴ 10⁻³ 10⁻² 10⁻¹ 10⁰ 10¹ 10² 10³

0.02 0.04 0.06 0.08 0.1 0.12 0.14

Second Moment Error

Figure 5: Comparison between a simulated process

andacreatedprocess. Example1.

4.2 Example2: Uplinkon small work-

group switch

Thedataused herecame fromamid-size workgroup

switch(Cisco2948G).Therewereabout36hostscon-

nected to it, distributed into twocategories: depart-

ment computersand 16 computersaccessibleto stu-

dents. Themeasurementswereperformedduringthe

summer of 2001, from the 7:th to the 30:th of July,

whichresultedinmorethan210 6

samples. Themea-

surementfocusedonthe interfacethatcorresponded

to the uplink of the switch. Thedata wascollected

usingasimpleSNMP (SimpleNetwork Management

Protocol) pollingtool(developed during 2001-2002).

Thetoolpolledthedeviceroughlyonceeverysecond,

withtheodddelay(probablyduetoprocessingtimes

in the device and intermediate devices). This jitter

isofnogreaterimportancesincethevaluesarerecal-

culated andstoredasrates,thusifthemeasure took

(5)

10⁰ 10¹ 10² 10³ 10⁴ 10⁵ 200

400 600 800 1000 1200

Second Moment

Measured Matched

10⁰ 10¹ 10² 10³ 10⁴ 10⁵

0.2 0.4 0.6 0.8 1

Second Moment Error

Figure 6: Comparison between a measured process

andacreatedprocess. Example2.

LookingatFigure6themeasuredprocessrstmo-

ment behaves as expected, but the second moment

seemstolackofaat,orsemi-atsection. Onepossi-

blereasonforthisbehaviorcouldthatthetracload

was low (measured during the summer), and most

of the trac that were present came from comput-

ers talking to computers in a (almost)deterministic

manner, e.g. WINS, NFS, etc. This type of source

generatestrac at discreteintervals, andthepacket

sizesarealmostalwaysthesame.

Turning the focus towardthe matched process a

under-estimationis noticed in the rst point. A so-

lution to this problem, and perhaps a renement of

themethod,wastoreapplythemethodtothewhole

set of data that remained after the rst cycle. By

doing this aeven better match wasachieved in this

point, butstill under-estimated(the otherpointsre-

mained unchanged sincethe method found that the

pointsalreadywereover-estimated,k<0). Oneway

toover-estimateall-pointswouldbeto addaprocess

with a time scale larger than the largest time scale

andusing ittoshiftthe entireprocessupward. This

wouldhoweverincreasetheerroratalltimescales.

Toseeifitwaspossibletogetevenbettermatches

themethod wasmodiedby setting k =1in Equa-

tion 15 and run it several times. The result was a

dramaticallyimprovedmatch,thecostwasansignif-

icantincreaseofprocesses.

5 Conclusions

Inthispaperwehavepresentedacrudemethodthat

allows us to match process parameters against real

network trac. It is possibleto get abetter match

usingmoreprocesses,this,however,willcostinlater

10⁰ 10¹ 10² 10³ 10⁴ 10⁵

200 400 600 800 1000 1200

Second Moment

Measured Matched

10⁰ 10¹ 10² 10³ 10⁴ 10⁵

0.05 0.1 0.15 0.2 0.25 0.3 0.35

Second Moment Error

Figure 7: The resulting match after running the

method5times,modifyingthemethod

possibleto get afairly good match using onlya few

processes. We need ameasurementtool that allows

ustomeasureatsmallertimescalesthanonesecond.

SNMPmeasurementseemsnottobeabletosupport

this, in fact severalmeasurementshave showedthat

theMIB (ManagementInformation Base)is notup-

dated in a correct way, but rather in 10 seconds in-

tervals (thisbehaviorwasmostnotably noticed in a

well-knownoperatingsystem).

References

[1] P. Carlsson and M. Fiedler. Multifractal prod-

uctsofstochasticprocesses: Fluidowanalysis.

Proceedings of 15th Nordic Teletrac Seminar

(NTS-15),Lund,Aug.22-24,2000.

[2] P.Carlsson,M.FiedlerandA.Nilsson.Voiceand

multifractaldata intheInternet.Proceedings of

26th IEEEConferenceon Local ComputerNet-

works(LCN2001),Tampa,Nov.15-17,2001.

[3] P. Carlsson, M. Fiedler and A. Nilsson. Mo-

ment analysis of sub-processes of multi-fractal

sub-processes,Internal Report,2002.

[4] P. Mannersalo, I. Norros, and R. Riedi. Multi-

fractal products of stochastic processes: A pre-

view.

COST-257 Technical Document 257TD(99)31.

http://nero.informatik.uni-wuerzburg.de/

cost/Final/TDs/257td9931.pdf