Using Mathematics for Data Traffic Modeling within an e-learning Platform

Transcription

1 6th WSES Iteratoal Coferece o EDUCTION ad EDUCTIONL TECHNOLOGY, Italy, November -3, Usg Mathematcs for Data Traffc Modelg wth a e-learg Platform Mara Crsta Mhăescu Uversty of Craova, Faculty of utomatcs, Computers ad Electrocs Software Egeerg Departmet Bvd. Decebal, Nr. 07, Craova, Dolj, Romaa bstract-e-learg data traffc characterzato ad modelg may brg mportat owledge about characterstcs of traffc. It s cosdered that wthout measuremet t s mpossble to buld realstc traffc models. We propose a aalyss archtecture employed for characterzato ad modelg usg data mg techques ad mathematcal models. The ma problem s that usually real data traffc has to be measured real tme, saved ad later aalyzed. The proposed archtecture uses data from applcato level. I ths way the data loggg process becomes a much easer tas wth practcally almost the same outcomes. I. INTRODUCTION Tesys e-learg platform was developed ad deployed. It has a bult mechasm for motorg actos performed by users ad data traffc trasferred durg usage. I ths paper we study the possblty of modelg data traffc usg data mg techques ad mathematcs based o performed actos. Ths would have great beefts regardg the overhead wth the platform. Itroducto presets short Tesys e-learg platform. I secod secto there are preseted the employed methods: actos ad data motorg, the process of clusterg users. The clusterg process groups smlar users based o a specfc smlarty fucto. t cluster level, self-smlarty of data traffc s the examed. Ths s accomplshed by estmatg Hurst parameter. I thrd secto of the paper there s preseted the proposed archtecture ad the aalyss process. I shor the archtecture ad employed process wll try to estmate the data traffc self-smlarty wth a cluster of users. I fourth secto there are preseted obtaed results. Fally, the coclusos ad future wors are preseted. Tesys s a e-learg platform that has bee desged ad mplemeted ad was deployed a cotuous learg program. Four types of users may use the platform: sysadm, secretary, professor ad studet. Secretares ad professors wor together to maage the frastructure the studet wll use. Secretares maage the professors, dscples ad studets. Professors tae care of the assged dscples terms of course materals, test ad exam questos. e-learg template mechasm creates course materals a very attractve ad teractve fasho. Professors ad studets commucate wth each other through a dedcated module of the platform. The studets are the ma beefcares of the platform. They ca dowload course materals tae tests at each chapter of the dscples ad tae the fal examato. They ca also commucate peer-to-peer wth professors ad secretares. The sysadm has more a supervsg role sce besdes maagg secretares he may obta formato regardg the actvty doe o the platform. The platform has bult capablty of motorg ad recordg user s actvty at applcato level. The actvty represets valuable data sce t s the raw data for our mache learg ad modelg process. User s sequece of sessos maes up hs actvty. sesso starts whe the studet logs ad fshes whe the studet logs out. Uder these crcumstaces, a sequece of actos maes up a sesso. II. METHODS ND MTERILS From the desg phase of the platform, there were adopted two methodologes for motorg actos. Sce the busess logc of the platform s Java based, log4j utlty pacage was employed as a loggg faclty ad s called wheever eeded wth the logc of the applcato. The utlty pacage s easy to use; log4j.propertes propertes fle maages the loggg process. The setup process states the logs are saved dd.log fle. The ma drawbac of ths techque s that the data from the fle s a sem-structured form. Ths maes the formato retreval to be ot so easy tas to accomplsh. O the advatages, loggg actvty may be very helpful audtg the platform or eve fdg securty breaches. Ths loggg faclty s also very helpful whe debuggg durg developmet or whe aalyzg pecular behavor durg deploymet. To overcome the sem-structured shape of logged actvty a structured way of gatherg actvty formato was eforced. The actvty table was added the database ad all actos were recorded the maer of oe record per acto. The felds of actvty table are: d (prmary ey), user d (detfes the user who performed the acto), date (stores the date whe the acto was performed), acto (stores a tag that detfes the acto), detals (stores detals about performed acto). The quatty of data traffc trasferred by users was also measured ad logged. Wheever a user made a request the sze bytes of the respose was measured ad saved. Stll, the recorded quattes of trasferred data were recorded at acto level. For example, f a user performs a test composed of 0 questos ths s recorded as a sgle data trasfer. The szes of questos are cumulated ad the result represets the data trasferred at the tme whe the test started. There are may dfferet ways for represetg patters that ca be dscovered by mache learg. From all of them we choose clusterg, whch s the process of groupg

2 6th WSES Iteratoal Coferece o EDUCTION ad EDUCTIONL TECHNOLOGY, Italy, November -3, a set of physcal or abstract objects to classes of smlar objects []. Bascally, for our platform we create clusters of users based o ther actvty. s a product of clusterg process, assocatos betwee dfferet actos o the platform ca easly be ferred from the logged data. I geeral, the actvtes that are preset the same profle ted to be foud together the same sesso. The actos mag up a profle ted to co-occur to form a large tem set [8]. There are may clusterg methods the lterature: parttog methods such as [9], herarchcal methods, desty-based methods such as [0], grd-based methods or model-based methods. Herarchcal clusterg algorthms le the Sgle-L method [4] or OPTICS [7] compute a represetato of the possble herarchcal clusterg structure of the database the form of a dedrogram or a reachablty plot from whch clusters at varous resolutos ca be extracted, as has bee show []. From all of these we chose to have a closer loo o parttog methods. From a dfferet perspectve for a cluster there may be computed the followg parameters: x + x x, the meas x + x x ( ) ( ) ( ) stadard devato p, the probablty,the The sum of all probabltes for all clusters s. If we ow whch of the dstrbutos each stace came from, fdg the parameters s easy. O the other had, f the parameters are ow fdg the probabltes that a gve stace comes from each dstrbuto s easy. Gve a stace x, the probablty that t belogs to cluster s: Pr[ x ] Pr[ ] f ( x;, ) p Pr[ x] Pr[ x] Pr[ x] where f ( x;, ) s the ormal dstrbuto fucto for cluster, that s: ( x ) f ( x;, ) e π The EM algorthm [] taes to cosderato that we ow ether of these thgs: ot the dstrbuto that each trag stace came from, or the parameters, or the probablty. So, we adopt the procedure used for the -meas clusterg algorthm ad terate. Start wth tal guess for the fve parameters, use them to calculate the cluster probabltes for each stace, use these probabltes to reestmate the parameters, ad repeat. Ths s called the EM algorthm for expectato-maxmzato. The frst step, the calculato of cluster probabltes (whch are the expected class values) s expectato ; the secod, calculato of the dstrbuto parameters s maxmzato of the lelhood of the dstrbutos gve the data [8]. slght adjustmet must be made to the parameter estmato equatos to accout for the fact that t s oly cluster probabltes, ot the clusters themselves that are ow for each stace. These probabltes just act le weghts. If w s the probablty that stace belogs to cluster, the mea ad stadard devato are: w x + w x w x w + w w ( x ) + w ( x ) w ( x ) w w + w w where x are all the staces, ot just those belogg to cluster. Techcally speag, ths s a maxmum lelhood estmator of the varace. Now we shall dscuss about how teratg process s termated. The -meas algorthm stops whe the classes of staces do t chage from oe terato to the ext a fxed pot has bee reached. I the EM algorthm thgs are ot qute so easy: the algorthm coverges toward a fxed pot but ever actually gets there. But we ca see how close t s by calculatg the overall lelhood that the data came from ths datase gve the values for the parameters (mea, stadard devato ad probablty). Ths overall lelhood s obtaed by multplyg the probabltes of the dvdual staces : ( p Pr[ x ] p Pr[ x B] ) + B where the probabltes gve the clusters ad B are determed from the ormal dstrbuto fucto f ( x;, ). Ths overall lelhood s a measure of the goodess of clusterg ad creases at each terato of the EM algorthm. ga, there s a techcal dffculty wth equatg the probablty of a partcular value of x wth f ( x;, ), ad ths case the effect does ot dsappear because o probablty ormalzato operato s appled. The upshot s that the lelhood expresso above s ot a probablty ad does ot ecessarly le betwee zero ad oe: evertheless, ts magtude stll reflects the qualty of the clusterg. I practcal mplemetatos ts logarthm s calculated stead: ths s doe by summg the logs of dvdual compoets, avodg all the multplcatos. But the overall cocluso stll holds: terate utl the crease log-lelhood becomes eglgble. For example, a practcal mplemetato mght terate utl the dfferece betwee successve values of log-lelhood s less tha 0-0 for te successve teratos. Typcally, the log-lelhood wll crease very sharply over the frst few teratos ad the coverge rather qucly to a pot that s vrtually statoary. lthough the EM algorthm s guarateed to coverge to a maxmum, ths s a local maxmum ad may ot ecessarly be the same as the global maxmum. For a better chace of obtag the global maxmum, the whole procedure should be repeated several tmes, wth dfferet tal guess for the parameter values. The overall log-lelhood fgure ca be used to compare the dfferet fal cofgurato obtaed: just choose the largest of the local maxma [8]. The EM algorthm s mplemeted Wea pacage[] ad eeds the put data to be a custom format called arff.

3 6th WSES Iteratoal Coferece o EDUCTION ad EDUCTIONL TECHNOLOGY, Italy, November -3, Self-smlarty ad log-rage depedece of data traffc are dscussed detal [3, 4 ad 5]. process s cosdered to be self-smlar f Hurst parameter satsfes the codto: ( ) H Y t a Y ( at) t > 0, a > 0, 0 < H < where the equalty s the sese of fte-dmesoal dstrbutos. secod defto of self-smlarty that s more approprate the cotext of stadard tme seres, volves a statoary sequece X X ( ), }. Let X ( m) m ( ) (/ m) X ( ), ( ) m+ { >,,... It s ot possble to use the defto to chec whether a fte traffc trace s self-smlar or ot. Istead dfferet features of self-smlarty such as slowly decayg varaces are vestgated order to estmate the Hurst parameter H. Parameter H ca tae ay value betwee / ad ad the hgher the value the hgher the degree of self-smlarty. For smooth Posso traffc the value s H0.5. There are four methods are used to test for self-smlarty. These four methods are all heurstc graphcal methods, they provde o cofdece tervals ad they may be based for some values of H. The rescaled adjusted rage plot (R/S plot), the Varace-Tme plot ad the Perodogram plo ad also the theory behd these methods, are descrbed detal by Bera [3] ad Taqqu et al. [5]. Molar et al. [6] descrbes the dex of dsperso for couts method ad also dscuss how the estmato of the Hurst parameter ca deped o estmato techque, sample sze, tme scale ad other factors. III. PROPOSED NLYSIS PROCESS The aalyss process starts from logged data about actos ad data traffc ad comes up wth a estmato of Hurst parameter. Ths estmato of self-smlarty represets mportat owledge characterzg ad modelg data traffc. I Fgure t s preseted the employed aalyss process. Fgure. alyss process. The aalyss process starts by creatg clusters of users based o ther actvty. For ths there s used oly the data regardg performed actos. Oce the clusters of users are obtaed, the data traffc trasferred wth each cluster s tae to cosderato by H Parameter Estmator module. Ths module wll produce three plots: R/S plo Varace- Tme plot ad the Perodogram plot.. The R/S method s oe of the oldest ad most well ow methods for estmatg H. Let Xt deote the umber of pacets that arrve at tme.e the umber of pacets b t. Y j X I represets the cumulatve flow up to tme j. The R/Sstatstc or rescaled adjusted rage s defed by the rato: R( ) R / S where S( ) R( ) max Yt + Yt 0 s called the adjusted rage ad S X ( Y Y ) m Y Y ( Y Y ) t t 0 t ( t ) ( X X ) +, where t + X maes t possble to study propertes that are depedet of scale. To determe the Hurst parameter H the rato R/S s calculated for every possble, or a suffcet umber of, values of t ad ad log R/S s plotted agast log. The slope of a straght le ftted to the pots the plo for stace by the least square method, s a estmato of the parameter H. For varace-tme plo frstly the mea of each par of cosecutve, o-overlappg bs are calculated ad the the varace of these meas s calculated. The -logarthm of the varace s plotted agast the logarthm of the bloc sze.e. The the same thg s doe for blocs of sze 4,8,6,..,legth(X)/ bs. The parameter H ca be estmated by fttg a smple least squares le through the resultg pots ad usg the relato slope H -. The perodogram s defed as: I N πn ( γ ) X ( j) j where γ s a frequecy, N s the legth of the seres, ad X s the tme seres. I(γ) s a estmator of the spectral desty. seres wth log-rage depedece should have a perodogram whch s proportoal to γ -H close to the org. estmato of H s gve by fttg a straght le to a log-log plot of the perodogram agast the frequecy. The slope of the le s approxmately -H. I practce oly the lowest 0% of the roughly N/ frequeces s used whe estmatg H [5]. IV. RESULTS The EM algorthm s mplemeted Wea pacage[8] ad eeds the put data to be a custom format called arff. Uder these crcumstaces we have developed a offle Java applcato that queres the platform s database ad crates the put data fle called actvty.arff. Ths process s automated ad s drve by a propertes fle whch there s specfed what data wll lay actvty.arff fle. The most mportat step ths procedure s the attrbute selecto ad the graularty of ther omal values. The e jγ t

4 6th WSES Iteratoal Coferece o EDUCTION ad EDUCTIONL TECHNOLOGY, Italy, November -3, umber of attrbutes ad ther meag has a crucal mportace for the whole process sce rrelevat attrbutes may degrade classfcato performace sese of relevace. O the other had, the more attrbutes we have the more tme the algorthm wll tae to produce a result. Doma owledge ad of course commo sese are crucal assets for obtag relevat results. For a studet our platform we may have a very large umber of attrbutes. Stll, our procedure we used oly three: the umber of logggs, the umber of tae tests ad the umber of set messages. Here s how the arff fle loos ooflogs ooftests oofsetmessages {<0,<0,<30,<50,>50} TBLE I DISTRIBUTION OF USERS IN CLUSTERS Cluster No. of users 0 9 (34%) 4 (6%) 35 (50%) For obtaed clusters a study of self smlarty of traffc was performed. More precsely, self-smlarty was studed for cluster 0 formed of 9 studets (34%). I 6 moth of fuctog o the platform there were executed over 0,000 actos of dfferet types: course dowloads, messagg, self tests, exams. For computatos a pacet was cosdered to have,000 bytes. For estmato of Hurst parameter there was chose a 3 hours terval, betwee 8:00 ad :00 whch s cosdered to be a heavy traffc perod. Ths may be observed from the geeral traffc statstcs preseted <50,<0,<0, >00,<0,<0, s t ca be see from the defto of the attrbutes each of them has a set of fve omal values from whch oly oe may be assged. The values of the attrbutes are computed for each of the 375 studets ad are set secto of the fle. For example, the frst le says that the studet logged less tha ffty tmes, too less tha te tests ad set less tha te messages to professors. The graularty for the omal values of the attrbutes ca be also creased. I our study we cosdered oly fve possble values but we ca cosder testg the algorthm wth more possble values. Ths should have great mpact o the umber of obtaed clusters. The tme tae by the algorthm to produce results should also crease. I order to obta relevat results we prued osy data. We cosdered that studets for whch the umber of logggs, the umber of tae tests or the umber of set messages s zero are ot terestg for our study ad degrade performace ad that s why all such records were deleted. fter ths step there remaed oly 68 staces. Rug the EM algorthm created three clusters. The procedure clustered 9 staces (34%) cluster 0, 4 staces (6%) cluster ad 35 staces (50%) cluster 3. The fal step s to chec how well the model fts the data by computg the lelhood of a set of test data gve the model. Wea measures goodess-of-ft by the logarthm of the lelhood, or log-lelhood: ad the larger ths quatty, the better the model fts the data. Istead of usg a sgle test se t s also possble to compute a cross valdato estmate of the log-lelhood. For our staces the value of the log-lelhood s whch represet a promsg result the sese that staces ( our case studets) may be classfed three dsjot clusters based o ther actvty. The clusterg process produced the followg results: Fgure. Geeral data traffc o e-learg platform The terval from 8:00 to :00 was chose for close aalyss. The R/S plot estmated H parameter to a value of The tme-varace plot showed a slope of whch meas a value of H of +slope/0.84. The IDC (Idex of Dsperso for Couts) shows a H parameter of I Perodogram plot there may be observed a value of H These methods do ot obta exactly the same values but values are over 0.5 whch s a good dcato of traffc s self-smlarty. Fgure 3. Estmato of Hurst parameter R/S plot

5 6th WSES Iteratoal Coferece o EDUCTION ad EDUCTIONL TECHNOLOGY, Italy, November -3, Havg md that o-statoary traffc may be easly tae as self-smlar statoary traffc there were also examed smaller tervals of tme bs. H parameter was estmated for each of the 6 tervals of 30 mutes betwee 8:00 ad :00. The results are preseted Fgure 7. Fgure 4. Estmato of Hurst parameter Varace-Tme plot Fgure 7. Estmato of Hurst parameter for tervals of 30 mutes from 8:00 to :00 I ths way, there was estmated H parameter for three hours from a complete terval of 4 hours. Estmato of H parameter for other tervals s preseted Fgure 8. Fgure 5. Estmato of Hurst parameter Perodogram plot Fgure 6. Estmato of Hurst parameter IDC plot The self-smlarty of byte traffc presets smlar values for H parameter. The umber of bytes trasferred each b were computed ad results preseted Table II. I ths table there are preseted estmatos of H parameter for dfferet dmesos of tme b. TBLE II HURST PRMETER ESTIMTES FOR 8:00-:00 TIME INTERVL B Pacets Bytes sze H R/S H VT H P H R/S H VT H P h h h Fgure 8. Estmato of Hurst parameter for each hour of traffc motorg Estmatos were accomplshed for pacet data traffc ad a tme terval of 5 mutes. ll three methods show hgh values betwee 5:00 ad 0:00. Because ths tme terval correspods to momets whe the platform was tesely used cofrms the researches of Lelad et. al. [7] that expressed the dea that whe etwor load s hgh tha the degree of self-smlarty s creased. The fact that traffc s foud to be self-smlar does ot chage ts behavor but t chages the owledge about real traffc ad also the way whch traffc s modeled. It has lead may [9] to abado the Posso-based modelg of

6 6th WSES Iteratoal Coferece o EDUCTION ad EDUCTIONL TECHNOLOGY, Italy, November -3, etwor traffc for all but user sesso arrvals. Real traffc, well descrbed as self-smlar, has a burst wth burst structure that caot be descrbed wth the tradtoal Posso-based traffc modelg. V. CONCLUSIONS Tesys e-learg platform was developed ad deployed. The platform has bult capablty of loggg actos performed by users ad data traffc quattes trasferred amog users. fter sx moth of usage, a large quatty of data was avalable to aalyze. Data aalyss s doe usg EM clusterg algorthm mplemeted by Wea system ad mathematcal traffc modelg. The user clusterg process produced three clusters of users. The mathematcal traffc modelg was performed o data obtaed for users that belog to a certa cluster. Mathematcal modelg estmates the self-smlarty of data traffc. Ths s accomplshed by heurstc graphcal methods: R/S plo varace-tme plo IDC plo perodogram plot. The aalyss s performed rgorously for a three hours terval, from 8:00 to :00 but also for the whole day. ll the aalyss follows a proposed aalyss process that has as put data regardg executed actos ad trasferred bytes wth the platform ad has as output estmates of the Hurst parameter. Values foud for Hurst parameter are very promsg. ll calculatos showed values above 0.7 ad may tmes above 0.8 whch dcate a good level of self-smlarty. The dffereces regardg Hurst parameter are due to estmato method, b sze ad pot of tme. s future wors t would be terestg to aalyze f there s a correlato betwee the user behavor ad the amout of data trasferred. Sce employed clusterg process parttoed users accordg wth ther behavor ths paper s a step showg that self-smlarty etwor traffc ca be explaed terms of user behavor. [0] R. grawal ad R. Sra Fast algorthms for mg assocato rules, Proc. of the 0th VLDB Coferece, pp , Satago, Chle, 994. [] B. Mobasher, N. Ja, E-H. Ha, ad J. Srvastava Web mg: Patter dscovery from World Wde Web trasactos, Techcal Report , Uversty of Mesota, Sep, 996 [] Holmes, G., Do,., ad Wtte, I.H., Wea: a mache learg worbech. Proceedgs of the 994 Secod ustrala ad New Zealad Coferece o Itellget Iformato Systems, Brsbae, ustrala, pp , 994. [3] J. Bera. Statstcs for Log-Memory Processes. Chapma & Hall, New Yor, 994. [3] W. Wllger, M. S. Taqqu, R. Sherma, ad D. Wlso, Selfsmlarty through hgh-varablty: statstcal aalyss of Etheret LN traffc at the source level, Proceedgs of SIGCOMM 95, pp [4] W. Wllger, V. Paxso ad M.S. Taqqu, Self-smlarty ad heavy tals: structural modelg of etwor traffc, practcal gude to heavy tals: statstcal techques ad applcatos, R. dler, R. Feldma ad M.S. Taqqu, Eds. Brhauser, Bosto, 998. [5] M. S. Taqqu ad V. Teverovsy, O estmatg the testy of lograge depedece fte ad fte varace tme seres, practcal gude to heavy tals: statstcal techques ad applcatos, R. dler, R. Feldma ad M.S. Taqqu, Eds. Brhauser, Bosto, 998. [6] S. Molar,. Vdacs ad. Nlsso, Bottleecs o the Way Towards Fractal Characterzato of Networ Traffc: Estmato ad Iterpretato of the Hurst Parameter. Iteratoal Coferece o the Performace ad Maagemet of Commucato Networ, Tsuuba, Japa, 7- November 997. [7] W. E. Lelad, M. S. Taqqu, W. Wllger ad D. V. Wlso, O the self-smlar ature of Etheret traffc (Exteded verso), IEEE/CM Trasactos o Networg, vol., o., pp. -5, 994. [8] Holmes, G., Do,., ad Wtte, I.H., Wea: a mache learg worbech, Proceedgs of the 994 Secod ustrala ad New Zealad Coferece o Itellget Iformato Systems, Brsbae, ustrala, pp , 994. [9] V. Paxso ad S.Floyd, Wde-area traffc: The falure of posso modelg, IEEE/CM Trasactos o Networg, vol. 3, o. 3, pp. 6-44, 995. REFERENCES [] Jawe Ha, Mchele Kamber Data Mg Cocepts ad Techques Morga Kaufma Publshers, 00. [] R. grawal ad R. Sra Fast algorthms for mg assocato rules, Proc. of the 0th VLDB Coferece, pp , Satago, Chle, 994. [3] MacQuee, J. Some Methods for Classfcato ad alyss of Multvarate Observatos. I 5th Bereley Symp. Math. Statst. Prob., 8-97, 967. [4] Ester M., Kregel H.-P., Sader J., Xu X.: Desty-Based lgorthm for Dscoverg Clusters Large Spatal Databases wth Nose, Proc. KDD 96, Portlad, OR, pp.6-3,996. [5] Sbso, R. SLINK: Optmally Effcet lgorthm for the Sglel Cluster Method. The Computer Joural, 6(): 30-34, 973. [6] ers M., Breug, M., Kregel, H-P., Sader, J. OPTICS: Orderg Pots to Idetfy the Clusterg Structure. I SIGMOD 99, 49-60, 999. [7] Sader, J., Q, X., Lu, Z., Nu, N, Kovarsy,. utomated Extracto of Clusters from Herarchcal Clusterg Represetatos. PKDD 03. [8] Ia H. Wtte, Ebe Fra Data Mg Practcal Mache Learg Tools ad Techques wth Java Implemetatos Morga Kaufma Publshers, 000. [9] Nasraou O., Josh., ad Krshapuram R., Relatoal Clusterg Based o a New Robust Estmator wth pplcato to Web Mg, Proc. Itl. Cof. North merca Fuzzy Ifo. Proc. Socety (NFIPS 99), New Yor, Jue 999.