Characterizing per-application network traffic using entropy

Reviewer: Amos O Olagunju

Several emerging algorithms for data mining, modeling, and simulation offer support for the visualization of business data and information. Business applications with intensive computational needs require the efficient use of bandwidth to effectively operate over the Internet. How should these increasingly multifaceted applications be characterized for the effective engineering of future networks and the Internet__?__ The authors of this paper examine entropy as a measure of the magnitude of the intricacy of per-application network traffic flow. They use real-time applications (Skype, iChat, and Google Talk) and streaming media (Hulu, Netflix, and ABC's webcam stream) to investigate self-similarity and develop an entropy metric for characterizing flow in network traffic. The experimental tcpdump of network traces consists of buffered, bursty, bandwidth-dependent, and codec-dependent applications that use the transmission control protocol (TCP) or user datagram protocol (UDP) to transport data. The cumulative distributions of the packet inter-arrival times of real-time and media streaming flows are displayed to illustrate patterns in the traffic. Flows for Skype voice over Internet protocol (VoIP) and video conferencing show distinct patterns of audio and video traffic. The patterns of iChat audio and video flows were similar, but the Skype audio flow pattern was less complicated than the iChat audio flow pattern. The flow pattern of Google Talk audio was less complicated than the Skype audio traffic flows, and the traffic flow patterns of Google Talk audio and video were different. There were no discernible differences in the traffic pattern flows of Hulu, ABC, and Netflix. The average flow rate of traffic is used to estimate self-similarity for forecasting network traffic flows. There was only weak evidence to support the self-similarity of video and audio flows in iChat and Skype traffic. Consequently, the authors developed a multiscale plug-in that estimates packet timing entropy, to capture the predictable finite memory of arriving packets in time intervals and compute the packet size sequences. They then use a flow trace of packet arrival timestamps to validate the accuracy of the entropy estimator. The entropy estimator is shown to be reliable in predicting the arrival of packets in time intervals for real-time and streaming media audio and video traffic flows. Unlike well-known predictors that assume distribution models to forecast traffic flows [1], the entropy estimator uses a table of bit patterns with associated probabilities in its prediction, without assuming any model. The entropy estimator generates entropic peaks for comparing and classifying video and audio applications. The authors provide valuable insights on the use of entropy estimator fingerprints for network intrusion detection, admission control of application flows, and strategic traffic scheduling based on the available bandwidth. Although the study only looked at the effects of packet timing on traffic flows and not packet size, all current and future network engineers should find this incredible paper interesting. Online Computing Reviews Service