Accurate and Efficient Traffic Monitoring Using Adaptive Non-linear Sampling Method

Transcription

1 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. Accurate ad Efficiet Traffic Moitorig Usig Adaptive No-liear Samplig Method Chegche Hu, Sheg Wag, Jia Tia, Bi Liu Tsighua Uiversity Beijig, Chia, 184 {hucc3,wags4,tiaj4}@mails.tsighua.edu.c liub@tsighua.edu.c Yu Cheg Illiois Istitute of Techology Chicago, IL USA, 6616 cheg@iit.edu Ya Che Northwester Uiversity Evasto, IL USA, 68 yche@orthwester.edu Abstract Samplig techology has bee widely deployed i measuremet systems to cotrol memory cosumptio ad processig overhead. However, most of the existig samplig methods suffer from large estimatio errors i aalyzig small-size flows. To address the problem, we propose a ovel adaptive o-liear samplig (ANLS) method for passive measuremet. Istead of statically cofigurig the samplig rate, ANLS dyamically adjusts the samplig rate for a flow depedig o the umber of packets havig bee couted. We provide the geeric priciples guidig the selectio of samplig fuctio for samplig rate adjustmet. Moreover, we derive the ubiased estimatio, the boud of the, ad the boud of required couter size for ANLS. The performace of ANLS is thoroughly studied through theoretic aalysis ad experimets uder sythetic/real etwork data traces, with compariso to several related samplig methods. The results demostrate that the proposed ANLS ca sigificatly improve the estimatio accuracy, particularly for small-size flows, while maitai a memory ad processig overhead comparable to existig methods. I. INTRODUCTION The Iteret has bee evolvig ito a commo commuicatio ifrastructure supportig a variety of applicatios, which at the same time requires dedicated etwork maagemet to ecessary quality of service provisio. Passive traffic measuremet is very importat to etwork maagemet, which ca provide various etwork status iformatio icludig traffic matrix, packet legth distributios, traffic volumes, sessio duratios, etc., to be exploited for chargig, egieerig, maagig, ad securig the commuicatio etworks [1] []. With the cotiuous icreasig of lie speed ad umber of flows, per-flow passive measuremet has become a challegig task due to the demadig requiremets o both memory size ad memory badwidth. Off-the-shelf memory is either high speed or high capacity. Large capacity DRAM ca hold more flow records but its low speed limits the samplig rate. Fast SRAM supports high speed samplig but is susceptible to overflow due to limited memory capacity. Thus, it is ecessary to develop a efficiet samplig method for This work is partly supported by NSFC (657311, 6651), Chia 973 program(7cb317),the Cultivatio Fud of the Key Scietific ad Techical Iovatio Project, MoE, Chia (753), the Specialized Research Fud for the Doctoral Program of Higher Educatio of Chia (6358), Tsighua Basic Research Foudatio(JCpy554). compromisig the above cotradictio [3] [4] [5] [6]. There are two geeric samplig approaches for passive measuremet: packet samplig ad flow samplig. The former samples each packet idepedetly with a certai probability, while the latter samples packets at the graularity of flows (i.e., packets i differet flows are sampled with differet samplig rates). The passive measuremet system/ifrastructure typically cosists of three compoets. A moitorig compoet tapped ito the etwork lik uses a samplig strategy to select packets ad forwards them to a reportig compoet. The reportig compoet aggregates the packet iformatio ito flow records ad exports them to a remote data ceter ad aalysis system compoet. The data ceter is equipped with high-desity data storage, which makes the measuremet results available to the aalysis system for differet applicatios. I this paper, we focus o the samplig strategy for the moitorig compoet ad study how to desig a efficiet samplig scheme that eables precise estimatios with a reasoable cost. A efficiet samplig method is expected to be applicable to differet types of applicatios, where differet sizes of flows may be of importace. For example, flow-level usage accoutig is essetial for maagemet applicatios [4] [5] [7], e.g., usage-based chargig/pricig, etwork plaig, ad traffic egieerig. For usage accoutig, the mai target is to catch the elephat flows (i.e., the flows of large size). For etwork security applicatios, the flow-level traffic patters ofte help reveal aomalies [8] [9] [1]. A typical sceario, a sharp icrease of 4 bytes TCP flows with oly oe packet is probably caused by SYN floodig attacks or flash crowds. Ulike the usage accoutig, etwork security applicatios require accurate estimatio o mice flows (i.e., the flows of small size). It is the diverse applicatio requiremets that motivate us to develop a ew samplig method, which should boud the estimatio error for both small ad large flows. The existig static samplig (SS) methods (as adopted by [3] [11] [1] [13]) selects packets with the same samplig rate/probability p. It ca be proved that the ubiased estimatio value of the is c/p ad the of this estimatio is (1/p 1)/, where p is the static samplig rate, c is the couter value for a sampled flow ad is the i terms of umber of packets (See the proof i Appedix). From the results, we ca see that the major problem of /8/$5. 8 IEEE

2 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. employig the static samplig method is its itolerably high for small flows. For istace, the will be 3% with p =.1 ad = 1. Usig a larger p ca mitigate the but lead to higher memory cosumptio, which coflicts with the purpose of samplig. I this paper, we propose a adaptive o-liear samplig (ANLS) method for passive measuremet. Istead of statically cofigurig the samplig rate, ANLS dyamically tues the samplig rate for a flow depedig o the umber of packets havig bee samples, which is maitaied by a couter. The ituitio of ANLS is to use a large samplig rate for small flows ad a small samplig rate for large flows. Specifically, this paper cotributes i the followig three aspects: 1) We provide the geeral priciples guidig the selectio of samplig fuctio for samplig rate adjustmet. The samplig rate is adjusted accordig to the couter value. There is o eed to predict or estimate the distributio. ) We derive the ubiased estimatio, the boud of the, ad the boud of the required couter size for ANLS. 3) The performace of ANLS is thoroughly ivestigated through theoretic aalysis ad experimets uder sythetic/real etwork data traces, with compariso to several related samplig methods. The results demostrate that the proposed ANLS sigificatly improve the estimatio accuracy, particularly for small-size flows, while maitaiig a memory ad processig overhead comparable to those of existig methods. Furthermore, distributio has almost o impact o the estimatio accuracy. The rest of the paper is orgaized as follows. Sectio II reviews the related work. Sectio III presets the proposed ANLS method. Sectio IV demostrates the properties of ANLS. Sectio V evaluates the performace of ANLS. Sectio VI gives the cocludig remarks. II. RELATED WORK A pioeerig work o statistical traffic samplig was published i [3], which uses static samplig to estimate the packet size distributio i a backboe etwork. The primary flowlevel measuremet tool used by etwork operators owadays is NetFlow [14], which resorts to packet samplig (kow as sampled NetFlow [13]), to hadle the large traffic volume ad diversity i high speed liks. Cosiderig the multi-hop feature of most flows, the work [11] [1] deployed the samplig system i a distributed maer for the purpose of passive measuremet. The sample ad hold method was itroduced i [7], which uses a small ad fast memory to process every packet i a real-time maer. This method is used to capture large flows but ot for small flows. CATE was proposed i [15] which estimates the proportio of each flow by makig multiple comparisos for each arrival ad coutig the umber of coicideces. This method is accurate for media-size ad large-size flows but is ot accurate for small-size flows. I the cotext of adaptive samplig, several mechaisms are itroduced for differet purposes. Better NetFlow (BNF) was Notatios c c t p P (c) f(c) b ˆ Q i () k p f u TABLE I TABLE OF NOTATIONS Descriptios the couter value the couter value i time t the static samplig rate the samplig rate whe the couter value is c, usig ANLS the samplig fuctio which is used to calculate P (c) the parameter of ANLS defied i f(c) the actual the estimatio of the probability that c = i whe actual is the parameter of CATE method the fial samplig rate of BNF the parameter of the samplig fuctio defied i Sectio IV proposed i [6] to improve memory utilizatio by a adaptive liear samplig method. A relatively large samplig rate is cofigured at the begiig of the measuremet iterval ad will adaptively decrease whe possible memory overflow is detected. A size-depedet samplig (SDS) mechaism was preseted i [5]. A flow whose size is larger tha z is always selected, while the flow with size x < z is sampled with probability x/z. The authors i [16] provided a importat theorem specifyig the miimum umber of packet samples required to be sampled to guaratee the expected, ad they also proposed a adaptive radom samplig (ARS) method. However, to utilize their theorem, it is required to first estimate the total packet amout usig a liear auto-regressive (AR) predictio model. The accuracy ad the implemetatio complexity of ARS are greatly restricted by the determiatio of the AR model parameters. All the above methods optimize o either the memory size or accuracy for medium to large flows, while the i estimatig small flows is cosiderably large. May previous works estimated the origial distributio from sampled flow statistics [4] [17] [18], or usig a data stream algorithm with lossy data structure [19]. The distributio is oe of the most fudametal statistics from which we ca deduce may other statistics, such as the total umber of flows ad the average. However, the distributio ca ot idicate flow-specific properties, e.g., accurate size estimatio for a particular flow or a subpopulatio, which is to be addressed i this paper. III. ADAPTIVE NON-LINEAR SAMPLING METHOD For coveiece, we summarize the mai otatios used i this paper i Table I, where the couter value ad flow size are i terms of umber of packets. With static samplig method of rate p, the couter value c t will be refreshed upo a packet arrival after time iterval t, accordig to the followig expressio { c t+t = c t +1 with probability p; c t with probability 1 p. The ANLS is proposed to replace the static samplig rate p i (1) with a fuctio P (c) over the couter value c. It is expected that P (c) dimiishes with the icreasig of c. Specifically, P (c) (1)

3 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. 1 P(c) f(c) 4 sample util the ed of the flow. Moreover, it is ot difficult to see that Q 1 (1) = 1 ad Q () =Q ( 1) =. Let F () deote the expectatio of ˆ(c) whe the actual is, wehave P(c).5 f(c) F () =E[ˆ(c)] = f(i)q i () (5) Based o (4) ad (5), we ca further have c Fig. 1. A example of f(c) ad P (c). for the proposed ANLS is calculated as P (c) =1/[f(c +1) f(c)], () where f(c) is a samplig fuctio to be selected accordig to the followig geeral priciples. Defiitio 1: Samplig fuctio f(c),c, is defied as a fuctio satisfyig the followig coditios: 1) a real icreasig covex fuctio; ) f() = ad f(1) = 1; 3) f(c) <f(c +1) bf(c)+1 with b>1 ad c>. Now, give a pre-defied f(c),c, we could adaptively tue the samplig rate depedig o the couter value. With the covexity, it is ot difficult to check that c [f(c + 1) f(c)] P (c). Namely, the samplig rate decreases as the couter value (as well as the ) icreases. A ice feature of ANLS compared to existig work is that the samplig rate is adjusted accordig to the couter value ad there is o eed to predict or estimate the distributio. I Fig. 1, we illustrate a example of f(c) ad P (c). IV. PROPERTIES OF ANLS I this sectio, we theoretically ivestigate the properties of adaptive o-liear samplig from the perspectives of accuracy, memory cosumptio ad processig overhead, with samplig fuctio selected accordig to Defiitio 1. A. Accuracy The accuracy i estimatig the ca be examied through two aspects: ubiased estimatio ad bouded relative error. 1) Ubiased estimatio: Theorem 1: Uder the ANLS method, ˆ(c) = f(c) is a ubiased estimatio of the. Proof: Let Q i () deote the probability that couter value c equals i whe curret actual is. Wehave, i 1 Q i () = P (j) (1 P ()) α...(1 P (i)) α i j= α +...+α i = i (3) Q i () =Q i 1 ( 1)P (i 1) + Q i ( 1)(1 P (i)). (4) where α j,j =,,i 1 represets the umber of usampled packets betwee the jth ad the (j +1)th sampled packets, ad α i represets the umber of usampled packets after the ith F () F ( 1) = f(i)[q i 1 ( 1)P (i 1) + Q i ( 1)(1 P (i))] f(i)q i ( 1)[P (i)+(1 P(i))] = f(i)q i 1 ( 1)P (i 1) f(i)q i ( 1)P (i) i= = f(i +1)Q i ( 1)P (i) f(i)q i ( 1)P (i) = [f(i +1) f(i)]q i ( 1)P (i). Accordig to (), f(i +1) f(i) =1/P (i). Thus, That is, F () F ( 1) = Q i ( 1) = 1. (6) F () = [F (i) F (i 1)] + F () =. (7) E[ˆ(c)] = E[f(c)] = F () =. (8) which represets a ubiased estimatio of the. ) Bouded : Theorem : Usig ˆ(c) =f(c) as the ubiased estimatio, b 1 the is upbouded by b 1. Proof: Let H() deote the expectatio of f (c) whe the is. Wehave H() =E[f (c)] = f (i)q i (). (9) Thus, from (4) ad (9), we get, H() H( 1) (1) = (f (i))[q i 1 ( 1)P (i 1) + Q i ( 1)(1 P (i))] (f (i))q i ( 1)[P (i)+(1 P(i))] = (f (i))q i 1 ( 1)P (i 1) (f (i))q i ( 1)P (i) i= = (f (i +1))Q i ( 1)P (i) (f (i))q i ( 1)P (i).

4 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. Sice f(i +1) f(i) =1/P (i) ad Q ( 1) =, wehave H() H( 1) = Q i ( 1)[f(i +1)+f(i)]. (11) Applyig Defiitio 1 ad Theorem 1, we obtai, H() H( 1) (1 + b) Q i ( 1)f(i)+1 ad therefore H() = =(1+b)F ( 1) + 1 =(1+b)( 1) + 1 [H(i) H(i 1)] + H() (b +1) (b 1). (1) The variatio of adaptive o-liear samplig is the computed as, Var[ˆ(c)] = H() F (b 1) (b 1) (), (13) ad the of ANLS ca be upbouded by, Var[ˆ(c)] (b 1) (b 1). (14) Theorem tells that the is zero whe is oe. The icreases with the icremet of, but coverges to (b 1)/ whe. The decreases as b dimiishes, while b should be larger tha oe as described i Defiitio 1. To give a ituitive illustratio, we select oe specific samplig fuctio accordig to Defiitio 1 as f(c) =[(1+u) c 1]/u, <u<1, (15) where u is a costat parameter. It ca be easily proved that (15) satisfies Defiitio 1 by settig b =1+u. FromTheorem 1, it is kow that ˆ(c) = [(1 + u) c 1]/u is a ubiased estimatio with (15) adopted as the samplig fuctio. I this case, we ca further obtai the accurate istead of a upper boud. Theorem 3: whe the samplig fuctio is f(c) = [(1 + u) c 1]/u, the of the ubiased estimatio is (1 1/)u/. Proof: From (15), we have, f(i +1) f(i) 1 = 1 u u [(1 + u)i 1] = f(i). Cosequetly, (11) is equivalet to H() H( 1) = Q i ( 1){f(i)+1+[f(i +1) f(i) 1]} = Q i ( 1)(f(i)+1)+u Q i ( 1)f(i) = ( 1) u( 1) static samplig/bnf, p=.5 adaptive samplig, µ=.1 adaptive samplig, µ= Fig.. Theoretical results of. Therefore, H() = ( 1) + u, (16) ad the variatio ad ca be obtaied as, Var[ˆ(c)] = H() (F ()) ( 1) = u. (17) ( 1) Var[ˆ(c)] u (1 1/) = = u (18) With Theorem 3 ad Theorem 6 (see Appedix), we ca examie the of ANLS ad static samplig versus the, as show i Fig.. Better NetFlow (BNF) [6] adaptively adjusts the samplig rate, but it samples all the flows with the same samplig rate. BNF ca be viewed as adaptive liear samplig sice it adjusts samplig rate liearly. If the fial samplig rate of BNF i a samplig iterval is p f, the of BNF is the same as the of static samplig with samplig rate p f. I other words, i theory, the curve of BNF is the same as that of static samplig (as show i Fig. ) with samplig rate p f. The advatage of BNF over static samplig is that it could fid a proper samplig rate automatically to cotrol the memory cosumptio (this is the motivatio of BNF). From the figure, we observe that 1) for the static samplig method, the relative error is quite large for small as we demostrated before; ) For the ANLS method, the is almost the same for differet values of ; 3) The of ANLS decreases as parameter u dimiishes. From the Lemma 4 i [15], we ca calculate the theoretical of CATE as follows, (1 p f )(1 + (k 1)p f /(1 + p f )) p f Nk (19) The theoretical results of CATE ad ANLS are listed i Table II. Whe we compute the results, the parameter for CATE is set as k = 1, ad the parameter for ANLS is cofigured as u =.. I this compariso, N =1 6, ad the traffic proportios for large-size flows, medium-size flows, ad small-size flows are.1.,.1., ad 1 7, respectively. The results idicate that ANLS is more accurate

5 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. tha CATE for medium-size ad small-size flows. It is a little bit less accurate for large-size flows for ANLS but the accuracy is reasoably acceptable. TABLE II THEORETICAL RELATIVE ERROR COMPARISON BETWEEN CATE WITH k = 1 AND ANLS WITH µ =.. Flow size Relative error of CATE Relative error of ANLS large-size medium-size small-size B. Memory cosumptio There are two parts of memory usage, the sample couters ad the precomputed mappig table for P (c) (equatio ), respectively. The former oe domiates the memory usage. 1) Memory for sample couters: Whe the actual is, the expected couter value i ANLS ca be calculated as E[c()] = Q i()i () for which we have the followig theorem. Theorem 4: The expected couter value E[c()] is upbouded by f 1 (), where f 1 () is the iverse fuctio of f(c). Proof: As idicated i Defiitio 1, f(c) is a covex fuctio, which satisfies f(x) f(y)+(x y)f r(y), x, y > (1) where f r( ) is the derivative of f( ) o the right. Now, let x = c ad y = E[c]. We get, f(c) f(e[c]) + (c E[c])f r(e[c]) () E[f(c)] E[f(E[c]) + (c E[c])f r(e[c])]. (3) Substitutig (8) ito (3), we obtai, E[f(c)] = f(e[c]) (4) Sice f(c) is a icreasig fuctio, we ca have E[c()] f 1 () (5) The samplig fuctio is specified i (15), ad the expected couter value of adaptive o-liear samplig method ca be accurately calculated by (3) ad (). We compare this calculated value with the boud idicated i Theorem 4 ad plot the gap betwee them i Fig. 3. The figure shows that the boud i Theorem 4 is a tight oe for the specific samplig fuctio defied i (15): the exact gap is very small ad the relative gap is approximately o the order of 1 4 or below. The couter values of the static samplig method ad ANLS are show i Fig. 4. Whe the is, the expected couter value for static samplig is obviously p. The couter value for adaptive o-liear samplig is larger tha the oe for static samplig whe is small, but it becomes much smaller tha the oe for static samplig whe grows. Please Gap betwee the boud ad the expected couter value # of couter bits Fig Gap betwee the boud ad the expected couter value. adaptive samplig, u=.1 adaptive samplig, u=. static samplig, u= Fig. 4. Couter bits required for differet samplig methods. ote that whe we desig the couter system, the width of the couter etry is determied by the largest couter value. Therefore, while keepig the same umber of etries, ANLS cosumes a smaller amout of memory tha static samplig. ) Memory for mappig tables: To avoid the high computatio overhead, we pre-compute the values of P (c) ad store it i a table. For o-lie operatio, we oly eed a sigle memory access to read out the required P (c). Cosiderig the worst case of a fully loaded OC-48 lik, which cotais oly oe flow with all 4-Byte packets. I this sceario, we could compute the flow legth i a oe-miute measuremet iterval, ad the the couter value will ot exceed f 1 () < 1 (actually it is about 999). We store a 16- bit for each P (c) where c 1. Therefore, the extra table to keep the mappig table P (c) is oly 16kb. Such amout of memory is ot large compared with that for couters ad i the evaluatios of Sectio V, we focus o the couter memory usage. C. Processig overhead The processig overhead is the computatio cost of processig each packet, icludig the memory accesses ad CPU operatios. There are five steps for the geeral samplig model. (i) the flow classificatio module picks up the flow ID from the icomig packet, (ii) the flow samplig module decides whether to sample the packet or ot. If yes, (iii) it fetches the couter address from the flow table, (iv) gets the couter value usig the address, ad (v) writes back the updated value to couter. Otherwise, drop the packet ad wait for the ext

6 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. Flow classificatio Fig. 5. (i) Flow Table Flow Mappig (iv) (ii) (iii) (v) System processig model of ANLS method. Couter packet. The ANLS model is i Fig. 5. (ii) fetches the couter address from the flow table, (iii) uses the address to read out the couter value, (iv) based o the couter value, the flow samplig module decides whether to sample ad update the couter or ot. From the model it is clear that we ca implemet ANLS usig a five-stage pipelie. Thus the most time-cosumig stage determies the processig speed. We aalyze the processig overhead of these five stages below. Classificatio stage ((i) i Fig. 5). Before decidig whether to sample a packet or ot, the associated flow ID eeds to be idetified. Such a flow classificatio is also required by other flow samplig methods, like BNF ad SDS. As the flow classificatio issue has bee extesively discussed i the literature [], we here igore the detailed descriptios due to space limitatios. Address fetchig stage ((ii) i Fig. 5). The processig is a table lookup operatio o a o-chip SRAM. Samplig rate computatio stage ((iv) i Fig. 5). A cocer of ANLS is that the samplig rate eeds to be calculated o the arrival of each packet. However, the computatioal complexity of P (c) should ot be a big issue whe ANLS is implemeted i the real system by hardware. The value of P (c) could be precomputed ad stored i a table. Thus we oly eed a direct address lookup o a table maitaied by a small (o-chip) SRAM. Memory I/O stages ((iii) ad (v) i Fig. 5). Sice the samplig method is utilized, the statistical results ca be kept i a SRAM. The operatio speed i this stage is determied by the access time o SRAM. From the aalysis above, we fid that the processig bottleeck is maily due to SRAM operatios. Suppose the frequecy of SRAM is MHZ ad, i the worst case, that each packet is 4 bytes. The I/O throughput of SRAM could match up to a 3 Gbps lik speed. Actually, the processig overhead for samplig ca be reduced greatly if the measuremet fuctio is implemeted by hardware i a router. A ituitive explaatio is that the processig for flow measuremet should be much simpler tha all the other processig fuctios i the router. By comparig with the other tasks processig i a router, the measuremet processig module should ot be a big cocer. Note that the flow measuremet module ca be a by-pass/parallel uit with all other data-path compoets i a router. Therefore, we ca tur to pay more attetio to the estimatio accuracy ad memory cosumptio for flow measuremet. V. PERFORMANCE EVALUATIONS I this sectio, we compare ANLS with other existig approaches icludig SS, BNF [6], SDS [5], CATE [15], ad ARS [16] i terms of accuracy, memory cost, ad processig overhead by performig two sets of experimets i the evaluatio comparisos: 1) employig sythetic traces to test the differet methods ad ) utilizig real IP data traces from NLANR [1] to validate our observatios. All the results i this sectio are obtaied by cofigurig the samplig fuctio of ANLS as the specific form i (15). Furthermore, we discuss the processig overhead of each method ad the attack resiliece of ANLS i this sectio. A. Experimets ad results o sythetic data I order to examie the effects of distributio o ANLS, we geerate sythetic data for experimets. Suppose that we measure a fully loaded OC-48 (.5 Gbps) lik with a oe-miute measuremet iterval. The required memory is calculated as the umber of etries multiplied by the bit width of the etry, sice each etry is of same width i real implemetatio as we metioed before. The couter width is determied by the largest flow to avoid overflow. Please ote that differet samplig approaches vary i the umber of etries ad etry width. We first geerate the flows whose sizes follow Pareto distributio (the shape parameter is 1.53 ad the scale parameter is 4). We also sythesize data flows with a expoetially distributed size (the locatio parameter λ =5, i.e., the mea is 5), ad with uiformly distributed size betwee 1 ad 1. The detailed results uder differet distributios are depicted i Table III, Table IV ad Table V. From the tables we observe that ANLS provides the most accurate estimatio ad that differet distributios have almost o effect o the average (i fact, the average relative error of ANLS is oly determied by the parameter u as we demostrated i Sectio IV). TABLE III MEMORY AND RELATIVE ERROR COMPARISON UNDER SYNTHETIC DATA GENERATED FROM PARETO DISTRIBUTION. Methods Parameters Average Memory ANLS u = Mb SS p = Mb BNF M = 56k Mb SDS z = Mb TABLE IV MEMORY AND RELATIVE ERROR COMPARISON UNDER SYNTHETIC DATA GENERATED FROM EXPONENTIAL DISTRIBUTION. Methods Parameters Average Memory ANLS u = Mb ANLS u = Mb SS p = Mb BNF M = 56k Mb SDS z = Mb

7 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. TABLE V MEMORY AND RELATIVE ERROR COMPARISON UNDER SYNTHETIC DATA GENERATED FROM UNIFORM DISTRIBUTION. Methods Parameters Average Memory ANLS u = kb SS p = kb BNF M = 56k kb SDS z = kb Fig. 7. BNF(M =k) or SS(p =1/) o NLANR trace. ANLS, µ=. Fig. 8. SDS with z = 1 o NLANR trace. Fig. 6. ANLS results o real NLANR trace. Table III demostrates the results for Pareto distributed flow size. Eve whe BNF (the M parameter i the table is the expected flow etry for BNF) is furished with a larger amout of memory comparable to ANLS, say 4.44Mb, its average is almost times worse tha ANLS. Table IV, for the experimets o expoetially distributed sythetic data, shows that ANLS eeds a slightly larger amout of memory tha BNF but will provide tes of times more accurate measuremet results. Whe a flow is geerated with a uiformly distributed size betwee 1 ad 1, ANLS has a average that is over 1 times better tha BNF at a cost of about two times as much memory as BNF, as showitablev. The average ad required memory size of SDS have o advatage over ANLS. Sice SDS optimizes the statistic of large flows, it requires a lot of memory to record large flows. Compared with BNF, SDS has more accurate results but requires a larger amout of memory. Sice CATE ad ARS deped o the packet arrival process, we do ot use sythetic data to evaluate these two methods. The comparisos with them will be preseted i Sectio V-B usig real traces. B. Experimets ad results o real traces Whe we use a OC-19 real trace published i [1] as the experimet iput, the results of ANLS are illustrated i Fig. 6, which shows the accuracy of ANLS for both small flows ad large flows. Fig. 6 also clearly validates Theorem 3, which claims that a smaller u is helpful to cotrol the. We also apply other samplig methods to aalyze the real trace ad depict the results i Fig. 7 to Fig. 1. All these methods demostrate a large for small flows. I [16], a perfect theoretical theorem is provided to guide the samplig method. However, to practically beefit from the theorem, we should have a pre-kowledge of the flow legth distributio. For this reaso ARS, which employs a AR model to predict flow legth distributio before decidig the samplig rate, is proposed. This method has the potetial flaw that the accuracy is greatly limited by the AR model. We test ARS o a real trace usig a AR(1) predictio model ad show the results i Fig. 1. Note that eve whe we use the actual data for the iitial iput to the AR(1) model, the for small flows is still larger tha ANLS as show i Fig. 6. Besides the compariso of accuracy, we further illustrate the memory sizes of all the approaches i Fig. 11. It is show that BNF cosumes the least amout of memory, while SDS requires the largest amout of memory due to its optimizatio o large flows. The memory requiremet for ANLS/ARS/CATE is similar. From the experimets o real traces, we foud that the memory cosumed by CATE is ot as small as expected i [15]. The differece probably comes from the assumptio i [15] that the packet arrival is uiform. I the experimet we observe may bursts of small flows, which will also make records i the coicidece cout table of CATE. Please ote that, the above memory expese correspods to differet samplig accuracy. The correspodig of s of BNF, ANLS, ARS, SDS ad CATE are 1.8,.1, 1.96, ad C. Processig overhead The processig overhead ca be measured by the umber of memory access ad CPU operatios, ad we summarize the results of differet methods i Table VI. As discussed i Sectio IV, for each packet, ANLS eeds oe read operatio, oe write operatio (update) o the couter, ad a further memory read operatio to get the pre-

8 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. memory size (kb) Fig. 9. CATE with k = 1 o NLANR trace. BNF 1 ANLS ARS 3 CATE 4 SDS 5 Fig. 11. Memory compariso of differet approaches o NLANR trace. The correspodig of s of BNF, ANLS, ARS, SDS ad CATE are 1.8,.1, 1.96, ad 6.11 TABLE VI PROCESSING OPERATIONS PER PACKET OF DIFFERENT METHODS. Methods ANLS SS BNF SDS CATE ARS memory access CPU operatio 1 1 Fig. 1. ARS o NLANR trace. Actual data is used for iitial iput of AR predictio model. computed samplig rate. Cosiderig the implemetatio of BNF, it eeds a additioal CPU operatio for re-ormalizatio. Although reormalizatio will ot block the accoutig process, it may delay the report process to the remote data collector if the reormalizatio is ot completed at the ed of the measuremet iterval. Additioally, to determie the samplig rate, BNF eeds to keep several histogram bis, which also cosume memory. O the arrival of a packet, the related histogram should be updated, ad all the histograms must be refreshed whe a re-ormalizatio process is activated. If a packet is sampled, BNF eeds oe write ad oe read operatio ad whe the samplig is adjusted, BNF eed two more memory accesses. I most cases, a total of 4 memory accesses are required. SDS uses a miimum ad divisio computatio to decide the samplig rate ad employs a maximum computatio for re-ormalizatio. For each packet, SDS requires oe write operatio ad oe read operatio o the memory. To implemet CATE, k comparisos eed to be doe for each icomig packet. It ca be deployed with a CAM, which requires oe memory access. Two more memory accesses (oe write ad oe read) are eeded if there is a hittig i the compariso. ARS utilizes a AR(), ( > 1) model, which icreases the memory cosumptio liearly with. Furthermore, to determie the parameters of the AR() model, we eed to solve liear equatios, ad its computatioal complexity is a bit high if gets large. A ice feature of ANLS compared to ARS is that the samplig rate is adjusted accordig to the couter value ad that o pre-kowledge o the distributio is required. Two memory accesses (oe write ad oe read) are eeded to update the couter. D. Attack resiliece ANLS keeps records for small flows. Although few resources are eeded to record each flow, oe may be cocered with the performace of ANLS whe a attacker lauches DoS attacks towards ANLS system with large umber of small flows. We use a trace file collected by NLANR durig the spread of the Slammer worm i Jauary 3 to test the attack resiliece of ANLS. Sice the average traffic rate of the origial trace is ot very large, we scale dow the time stamp i each packet so that the flows will fully utilize the liks of 1Mbps ad 1 Gbps respectively. Whe the measuremet iterval is set as 5 secods, the required memory size is show i table VII, which implies that ANLS is resiliet to DoS attacks. TABLE VII RESILIENCE TO ATTACK TRACES. traffic load 1 Mbps 1 Gbps flow etries memory size 134 kb 441 kb E. Summary From the above results, the desig spaces of differet samplig methods ca be summarized i Table VIII, where A, B, C or D is used to idicate that the performace of a method is excellet, good, acceptable, orbad for a certai metric. ANLS bouds the error for both large ad small flows. The aalysis of the ad the upper boud for couter size, give i Sectio IV, ca also be exploited to tackle the tradeoff i case that the memory costrait or error costrait is give. I fact, from Fig. ad Fig. 4, we could fid out that, icreasig u will decrease memory requiremet relatively quickly while slightly icreasig the. For real implemetatio, u ca ot be arbitrarily large sice it is limited by the costraits of the implemetatio ad expected error.

9 This full text paper was peer reviewed at the directio of IEEE Commuicatios Society subject matter experts for publicatio i the IEEE INFOCOM 8 proceedigs. TABLE VIII DESIGN SPACES FOR DIFFERENT METHODS. Methods ANLS SS BNF SDS CATE ARS Accuracy for small flows A D D D D C Accuracy for media/large flows B B B A A B memory B B A C B B processig C A B C C C VI. CONCLUSION We have proposed a adaptive o-liear samplig method (ANLS) for passive measuremet with the purpose of mitigatig the high for small evets itroduced by static samplig. The basic idea is to sample a small flow with a large samplig rate ad to sample a large flow with a small samplig rate. ANLS has ubiased estimatio ad bouded for the estimatio, ad bouded couter size which implies small memory cosumptio. I particular, ANLS sigificatly improves the estimatio accuracy for small flows compared to existig methods, while maitaiig similar memory size ad processig overhead. ANLS tues the samplig rate accordig to the couter value, ad o predictio or estimatio of the distributio is required. The experimetal results show that the proposed samplig method obtais a better tradeoff betwee ad memory size cosumptio, i compariso to existig samplig methods. I additio, distributio has almost o effect o the estimatio accuracy. APPENDIX ESTIMATION AND ERROR OF STATIC SAMPLING Theorem 5: ˆ(c) = c/p is a ubiased estimatio of the uder the static samplig method. Proof: From the defiitio of the expected value of ˆ(c), we have, E[ˆ(c)] = ( ) p i (1 p) i i i p = ( 1)! (i 1)!( i)! pi 1 (1 p) i = (p +1 p) 1 =. Theorem 6: (1/p 1)/ is the of ubiased estimatio uder the static samplig method. Proof: E[ˆ (c)] = ( = p i ) p i (1 p) i ( i p ) i( 1)! (i 1)!( i)! pi 1 (1 p) i From the defiitio, we have the Var[ˆ(c)] = (1/p 1)/. REFERENCES [1] K. Claffy ad S. McCreary. Iteret measuremet ad data aalysis: Passive ad active measuremet. [Olie]. Available: org/outreach/papers/1999/nae4hase/nae4hase.html [] G. Varghese ad C. Esta, The measuremet maifesto, ACM SIG- COMM Computer Commuicatio Review, vol. 34, pp. 9 14, 4. [3] K. C. Claffy, G. C. Polyzos, ad H.-W. Brau, Applicatio of samplig methodologies to etwork traffic characterizatio, i ACM SIGCOMM 1993, 1993, pp [4] N. Duffield, C. Lud, ad M. Thorup, Estimatig flow distributios from sampled flow statistics, i ACM SIGCOMM 3, 3, pp [5], Lear more, sample less: Cotrol of volume ad variace i etwork measuremet, IEEE Tras. Iform. Theory, vol. 51, pp , 5. [6] C. Esta, K. Keys, D. Moore, ad G. Varghese, Buildig a better etflow, i ACM SIGCOMM 4, 4, pp [7] C. Esta ad G. Varghese, New directios i traffic measuremet ad accoutig, i ACM SIGCOMM,, pp [8] D. Brauckhoff, B. Tellebach, A. Wager, A. Lakhia, ad M. May, Impact of traffic samplig o aomaly detectio metrics, i ACM SIGCOMM IMC 6, 6, pp [9] J. Mai, C.-N. Chuah, A. Sridhara, T. Ye, ad H. Zag, Is sampled data sufficiet for aomaly detectio? i ACM SIGCOMM IMC 6, 6, pp [1] K. Ishibashi, R. Kawahara, T. Mori, T. Kodoh, ad S. Asao, Effect of samplig rate ad moitorig graularity o aomaly detectability, i 1th IEEE Global Iteret Symposium, 7. [11] C. Hu, B. Liu, Z. Liu, S. Gao, ad D. O. Wu, Optimal deploymet of distributed passive measuremet moitors, i ICC 6, vol., 6, pp [1] K. Suh, Y. Guoy, J. Kurose, ad D. Towsley, Locatig etwork moitors: Complexity, heuristics, ad coverage, i INFOCOM 5, vol. 1, 5, pp [13] Cisco. Sampled etflow data sheet. [Olie]. Available: data sheet9186a8811.html [14]. Cisco ios etflow data sheet. [Olie]. Available: data sheet9aecd8173f71.html [15] H. Fag, M. Kodialam, T. V. Lakshma, ad Z. Hui, Fast, memoryefficiet traffic estimatio by coicidece coutig, i INFOCOM 5, vol. 3, 5, pp [16] B.-Y. Choi, J. Park, ad Z.-L. Zhag, Adaptive packet samplig for flow volume measuremet, Uiversity of Miesota, MA, Tech. Rep. TR -4, Dec.. [17] N. Hoh ad D. Veitch, Ivertig sampled traffic, i ACM SIGCOMM IMC 3, vol. 14, 3, pp [18] L. Yag ad G. Michailidis, Sampled based estimatio of etwork traffic flow characteristics, i INFOCOM 7, 7. [19] A. Kumar, M. S. amd J. J. Xu, ad J. Wag, Data streamig algorithms for efficiet ad accurate estimatio of distributio, i ACM SIGMETRICS 4, 4, pp [] K. Zheg, H. Che, Z. Wag, B. Liu, ad X. Zhag, Dppc-re: Tcambased distributed parallel packet classificatio with rage ecodig, IEEE Tras. Comput., vol. 55, pp , 6. [1] NLANR. Passive measuremet ad aalysis (pma). [Olie]. Available: = 1 (i +1)( 1)! p i (1 p) i 1 p i!( i)! = p [( 1)p +1]= + (1/p 1).