This paper provides a deep analysis of long-range dependence in a continually evolving Internet traffic mix by employing a number of recently developed statistical methods. Our study considers time-of-day, day-of-week, and cross-year variations in the traffic on an Internet link. Surprisingly large and consistent differences in the packet-count time series were observed between data from 2002 and 2003. A careful examination, based on stratifying the data according to protocol, revealed that the large difference was driven by a single UDP application that was not present in 2002. Another result was that the observed large differences between the two years showed up only in packet-count time series, and not in byte counts (while conventional wisdom suggests that these should be similar). We also found and analyzed several of the time series that exhibited more "bursty" characteristics than could be modeled as Fractional Gaussian Noise. The paper also shows how modern statistical tools can be used to study long-range dependence and non-stationarity in Internet traffic data.

Abstract

This paper studies tails of the size distribution of Internet data flows and their "heaviness". Data analysis motivates the concepts of moderate, far and extreme tails for understanding the richness of information available in the data. The data analysis also motivates a notion of "variable tail index", which leads to a generalization of existing theory for heavy-tail durations leading to long-range dependence.

In this paper we develop a stochastic differential equation to describe the dynamic evolution of the congestion window size of a single TCP session over a network+ The model takes into account recovery from packet losses with both fast recovery and time-outs, boundary behavior at zero and maximum window size, and slowstart after time-outs+ We solve the differential equation to derive the distribution of the window size in steady state+ We compare the model predictions with the output from the NS simulator+

For bivariate heavy tailed data, the extremes may carry distinctive dependence information not seen from moderate values. For example a large value in one component may help cause a large value in the other. This 1 is the idea behind the notion of extremal dependence. We discuss ways to detect and measure extremal dependence. We apply the techniques discussed to internet data and conclude that for Þles transferred, Þle size and throughput (the inferred rate at which the Þle is transferred) exhibit extremal independence.