SPSD: An alternative attribute for a flow using packet sampling

  • Lei Ding
  • , Jun Liu
  • , Tao Qin
  • , Max Haifei Li

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Packet size distribution (PSD), known as the probability distribution of packet size in a flow, is an important attribute for traffic analysis. However, to get a flow's precise PSD is computationally intensive due to the massive flows in networks and massive packets in some flows. In this paper, we propose an alternative attribute, sampled packet size distribution (SPSD), which can give a proper estimation of PSD. We introduce a bi-directional flow model and the probability representation of SPSD. Generating method of SPSD is also given, where SPSD is collected from a sampled trace, which makes it easier to get and have a great reduction in the number of packets being processed. Based on a real trace collected from the campus network, we confirm that SPSD varies slightly from PSD on low sampling granularity. The cosine and KL distances between SPSD and PSD of a flow are less than 10-2 and 10-1 respectively. Also, the orderliness of PSD distance sequence is well preserved when SPSD used.

Original languageEnglish
Title of host publicationProceedings of the 28th Chinese Control and Decision Conference, CCDC 2016
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages5125-5131
Number of pages7
ISBN (Electronic)9781467397148
DOIs
StatePublished - 3 Aug 2016
Event28th Chinese Control and Decision Conference, CCDC 2016 - Yinchuan, China
Duration: 28 May 201630 May 2016

Publication series

NameProceedings of the 28th Chinese Control and Decision Conference, CCDC 2016

Conference

Conference28th Chinese Control and Decision Conference, CCDC 2016
Country/TerritoryChina
CityYinchuan
Period28/05/1630/05/16

Keywords

  • Packet sampling
  • Packet size distribution
  • Traffic classification

Fingerprint

Dive into the research topics of 'SPSD: An alternative attribute for a flow using packet sampling'. Together they form a unique fingerprint.

Cite this