A State-Space Approach for Optimal Traffic Monitoring via Network Flow Sampling

06/24/2013 ∙ by Michael Kallitsis, et al. ∙ University of Michigan 0

The robustness and integrity of IP networks require efficient tools for traffic monitoring and analysis, which scale well with traffic volume and network size. We address the problem of optimal large-scale flow monitoring of computer networks under resource constraints. We propose a stochastic optimization framework where traffic measurements are done by exploiting the spatial (across network links) and temporal relationship of traffic flows. Specifically, given the network topology, the state-space characterization of network flows and sampling constraints at each monitoring station, we seek an optimal packet sampling strategy that yields the best traffic volume estimation for all flows of the network. The optimal sampling design is the result of a concave minimization problem; then, Kalman filtering is employed to yield a sequence of traffic estimates for each network flow. We evaluate our algorithm using real-world Internet2 data.



There are no comments yet.


page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

Advances in networking technologies and high performance computing have led to an unprecedented growth of a vast array of applications such as cloud computing, social networking, video on demand, cloud storage, and voice over IP, to name a few. At the same time, malicious network activity remains a big concern since network attacks become more sophisticated. Therefore, it is extremely important for network operators to have an accurate global-view of their network for diagnosing anomalous activity [19], for optimal network capacity planning and quality of service considerations [5]. These can be achieved through network monitoring. However, monitoring everywhere and constantly is expensive, energy inefficient and computationally challenging. Thus, one should employ statistical tools for traffic estimation through limited collection of measurements.

Network monitoring has traditionally been done with SNMP measurements [5, 23, 32]. SNMP measurements provide link counts which give the aggregate traffic volume at the observation point of interest. Recently, more granularity can be achieved by performing flow-level measurements using tools such as Cisco’s NetFlow. The latter approach simplifies the monitoring task significantly. The idea is to sample packets from flows of interests at specific router interfaces, henceforth called observation points. For each packet sampled, several header information can be extracted and recorded for further analysis. Each packet from a flow (a flow can be an aggregate flow, i.e., flows originating from a particular subnet or an autonomous system) is sampled independently with a particular

sampling probability

(also known as sampling rate). Typical sampling rates are between (i.e., only 1 out of 100 packets is selected for sampling) and . Higher sampling rates can also be chosen, but they amount to valuable resource consumption at each router (cache memory, CPU cycles, storage, network bandwidth and power). Thus, judicious choice of the sampling rates greatly affects the efficient operation of the network.

Regardless of the measurement technique, network monitoring aims to several objectives: a) identification of the traffic volume for network flows (known as traffic matrix[26, 21, 23, 32, 27, 13], i.e., traffic for each origin-destination pair given the link counts and the topology of the network, b) identification of flow characteristics such as end-to-end network delay [4, 20, 6], flow length, flow distribution or other flow statistics [31, 10, 12]. To accomplish these, several interesting problems arise, such as the subset selection problem for choosing the locations of the monitoring stations [4, 6] and the sampling design problem [26].

This paper aims to address the problem of flow estimation through an optimal sampling strategy under resource constraints (see also [11]). We assume that network monitoring is performed via Netflow-alike measurements. Our framework takes into account both temporal correlations of the flows (see also [13]) as well as their spatial correlation [14]. We adapt Bernoulli sampling for our measurements at each observation site (that is, the information of a packet at each network link is recorded according to the sampling rate/probability described above), but alternative sampling techniques can aslo be considered [8, 7, 9].

The toy-example of Figure 1 provides more insights on the proposed method; assume we have flows between each network node. Further, assume flow-monitoring tools can sample with rate out of every packets. How should the network operator assign the sampling rates to each flow subject to the sampling capacity of each link? By considering the network topology, one would expect that “long-flows” do not require many samples at every single link they traverse. For example, the flow from ’Houston’ to ’NY’ needs not be sampled at every link on its path. Sampling on link ’Houston’ - ’Kansas’ may be sufficient; this will leave the resources of the intermediate link to be utilized for monitoring the “short” flow that traverses only the link ’Kansas’ to ’Chicago’. Similarly, a stochastic characterization of the “evolution” of each flow over time provides valuable information for choosing the “’best” sampling strategy. Section 2 unifies these ideas in a stochastic optimization framework.

Similar approaches for flow estimation via state-space models have also appeared in [26, 27]. However, in [26] the proposed method addresses flow estimation on a single network link and the spatial correlation between flows are not examined. In [27], the suggested state-space model considers link counts at every network link without relying on flow sampling (in particular, SNMP counts are considered). In large-scale networks this approach is not practical nor feasible. Further, compared to [27], we study a framework better-tailored to the ongoing measurement process.

The contributions of this paper are twofold: a) We present a stochastic optimization framework for finding the optimal sampling design that would yield the best traffic estimates for each flow (section 2). The model views each flow as a stochastic process. The state of the system at a particular time instance is the volume of traffic that each flow carries at that instance. Through sampling, we get a partially observed system; this observation uncertainty is captured through the measurement equations we define next. The goal is to find the “best” sampling strategy that minimizes the estimation error over the (finite) horizon of interest. This is the first attempt to model the flow estimation problem under a stochastic control framework; b) We study an approximation scheme for the solution of the above-mentioned stochastic optimization problem (section 3). The problem of obtaining the optimal sampling rates is then reduced to a deterministic optimization problem that can be solved a priori. Based on the calculated sampling rates, traffic estimation for each time-step is then performed via the Kalman filter. As illustrated in Figure 2 the proposed approach poses significant gains over existing techniques. We evaluate our approach using real-world data obtained from Internet2 (section 4).

Figure 1: Backbone network of Internet2.

2 Problem Description

Consider a communication network of nodes and links. The total number of traffic flows, i.e. source and destination pairs, is denoted by . We denote the set of flows as and the set of all network links with . Traffic is routed over the network along predefined paths described by a routing matrix with and otherwise. Let


be the vector time series

111Here, time is discrete and traffic loads are measured in bytes or packets per unit time, over a time scale greater than the round-trip time of the network. of traffic traversing all routes and links, respectively. We shall ignore network delays and adopt the assumption of instantaneous propagation. This is reasonable when traffic is monitored at a time-scale coarser than the round-trip time of the network, which is the case in our setting. We thus obtain that the link and route level traffic are related through the fundamental routing equation222 Note that an in backbone IP networks the routing matrix does not change often.


The spatial correlation between flows encoded in the routing matrix , will play an important role in determining the optimal sampling design. Before discussing the solution of our optimization problem though, we first consider in detail all the components of our stochastic control formulation.

Figure 2: Estimation error per time interval: comparison of optimal versus naïve sampling for the Internet2 flows on 2009-03-17.

2.1 A State-Space Model

In this paper, we model the evolution over time of the volume of each flow as a stochastic process. In particular, we model the dynamics of each flow , as the following Markov process:


where represents the state of flow at time , namely the numbers of packets (or bytes) carried at time interval . For the purposes of this paper we assume that each time interval has a duration of

minutes. The sequence of random variables

represent random noise. They belong to the set of primitive random variables

, meaning that they are mutually independent. They are also independent from the state random variables. We assume noise to be Gaussian with zero mean and variance equal to

. To fully characterize the system evolution for flow of Eq. (2) we need initial state , which is also assumed to be Gaussian. Its mean and variance can be calculated during a calibration phase. To summarize, for , the system dynamics are described by


with being the vector representing the “state” of each flow at time , and a diagonal matrix of the coefficients

. Moreover, we have the following probability density functions for the primitive random variables described above, i.e.,


The parameters , , and

can be determined through a short calibration phase using techniques for fitting autoregressive models (see 

[3], Chapter 8).

2.2 Traffic Measurement

2.2.1 Bernoulli flow sampling

As mentioned above, at time the volume of flow is denoted by the state variable . We adopt a Bernoulli sampling scheme [12]. This says that each packet of flow passing through the observation point at time , is sampled with probability . In other words, the variable specifies the sampling rate at link for flow at time .

The number of packets captured at observation point for flow is given by the random variable . Given ,

follows a binomial distribution, i.e.,


Based on the observations

, the unbiased estimator for

– the traffic volume at link for flow – is given by:


The variance of the estimator at link for flow equals


2.2.2 Spatial combination of estimators

We seek a combined estimator for the volume of flow that uses measurements from several observation points [14]. Such an estimator can be expressed as,


where is the set of links that flow traverses. Conditioned on the state , the observations at different links are independent so one can calculate the variance of the combined estimator to be


where (see Eq. (2.2.1)) and is the set of links that flow is traversing and can be acquired from the routing matrix . To obtain the best linear unbiased estimator for all , we want to find the optimal weights that minimize the above variance subject to . Taking the Lagrangian and using the first-order optimality conditions we arrive to


Continuing from (10),


2.2.3 The Measurement Equation

From Eqs. (6), (7), (9) we see that we have a partially observable system. In other words, the state of the system – the traffic volume for each flow at – is not directly available, but can be inferred through the observations . Using the normal approximation to the binomial distribution we get the following relation between the state and observations for flow , for


where is a Gaussian random variable, i.e. (see Eq. (12))


The measurement equation, for all flows becomes


with the probability density function for being


where is a covariance matrix. Using the proposed measurement scheme, the covariance matrix is just a diagonal matrix with elements the variances shown in Eq. (14).

2.3 The Instantaneous Cost

Let be the sampling matrix arranged in a vector form; the variable specifies the sampling rate at link for flow at time . We define the instantaneous cost to be the estimation error at time as follows:


where is the vector of volume estimation for each flow at time (see Eq. (9) and (11)).

The instantaneous cost of (17) can then be written as:

Proposition 1

The instantaneous cost function shown in (18) is concave in .

Using the expanded form of Eq. (18) with we observe that this resembles the harmonic average of the terms . Using the fact that the harmonic average function is a concave and non-decreasing function [2], one can easily verify that our objective function is concave in as a composition of a concave and non-decreasing function with a convex function.

3 Optimal Sampling

The problem at hand belongs to the category of measurement adaptive problems [30]. In the general case, the problem of optimal measurement control (see also sequential design of experiments [25]) can be formulated as the following discrete-time, finite-horizon, partially-observable, perfect-recall stochastic control problem (see [30, 18]).

We are given, the system evolution equation, written as


the measurement equation


and the probability densities for the random variables , and


The performance criterion is the expected cost over the horizon of interest


where is the instantaneous cost function and the expectation is taken with respect to the random variables .

The problem is to find the optimal sampling strategy

that minimizes the expected cost (22) over the horizon of interest subject to “budgetary” sampling constraints. The symbol


represents the history of observations up to time . Simi-larly, the history of sampling rates up to time will be denoted as . As mentioned above, we assume a system with perfect-recall which means that all this information is available. Having calculated an optimal sampling strategy, the optimal sampling action at time instance would be


In other words, given the history of observations, the optimal action would at time will be given by the pre-calculated optimal policy.

In the general case, applying dynamic programming is hindered by the curse of dimensionality [24]. Therefore, some sort of approximation techniques need to be involved [24, 1]. Indeed, under the following conditions, the stochastic control problem can be solved efficiently [22] by exploiting the two-way separation between estimation and control [30, 18]. The conditions333The models presented in [22, 30, 18] cover more general cases than the one presented here. Specifically, in the general model the state of the system needs to be controlled as well, and a quadratic cost is associated with the system state. Further, a quadratic cost in the decision variables may also exist. are: a) The system evolution equation (see Eq. (19)) is linear; b) The measurement equation (see Eq. (20)) is linear in the state and measurement noise; c) The primitive random variables are Gaussian; and d)The instantaneous cost (in our case given by Eq. (17)) is independent of the state .

In the special case we have a state equation of the following form


a measurement equation of this form


where relates the measurement matrix with the measurement control. The probability density functions of the primitive random variables are


where gives the relationship between measurement noise and sampling rate. The performance criterion is


subject to constraints on .

Given the above conditions and the sampling rates , traffic volume estimation can be performed with the Kalman filter [17]. , the optimal estimate conditioned on , is given by


where , the Kalman gain, is


and , the conditional covariance of the error in the estimate of given can be calculated recursively for by


The computation of the optimal sampling rates can be determined a priori by calculating the solution of the following nonlinear, deterministic control problem:


subject to the “budgetary” sampling constraints. is the “best” state estimator available at the time the optimization problem is solved.

The optimization problem (34) can be decomposed into a sequence of problems. For time , and given the state estimation we have:


where is the vector of sampling rates, represent linear “budgetary” constraints per link, and B is a matrix of appropriate dimensions (deduced from the routing matrix R). The concavity of our objective function, along with the linearity of our constraints lead us to a minimization of a concave function. This is an NP-complete problem, known as global concave minimization.

The solution of the concave program always lies on the vertices of the convex hull defined by the convex polyhedron of our linear “budgetary” inequalities shown in Eq. (35). The proof can be found in [15]. The above proposition suggests that one way to solve our concave program – but certainly not the most efficient one – is to enumerate all the vertices of the induced convex hull, and pick the one that yields the lowest error. More sophisticated methods for solving concave programs can be found in [15, 29]. The complete traffic estimation algorithm is presented next.

Algorithm 1 (Optimal Sampling)
  1. For collect traffic data to calibrate the model; i.e., find , , and .

  2. For , set , and solve (34). We have now obtained , for .

  3. Using the optimal sampling rates of Step 2) and Eqs. (32) and (3) calculate the Kalman gain.

  4. Using Eq. (9) get the combined observation for each flow .

  5. With the observations acquired from (9), use the Kalman filter (31) to obtain the traffic volume estimation for time , given the past of observations.

  6. Set and go to Step 3). Repeat until .

4 Performance Evaluation

(a) Largest flow.
(b) Second largest flow.
(c) Third largest flow.
Figure 3: Traffic estimation for different flows.

We use a real-world network, namely Internet2, to evaluate our algorithm. We juxtapose our method against a naïve sampling scheme (i.e., sampling rates not chosen optimally; Kalman filtering is still used though). Internet2 involves links, nodes and routes (see [28, 16]). In particular, we employ a dataset for traffic captured on March 17, 2009. The dataset includes the traffic volume of the flows, and the routing matrix (see Eq. (1)) which gives the path that each flow traverses in the network444All datasets used can be provided by the authors upon request.. In all examples that follow, a training window of time slots was applied to calibrate our model (see Step 1 of Algorithm 1).

In the naïve sampling scheme we evenly split the available sampling capacity among the competing flows of a link. We assume that the sampling capacity for each of the network links is . Figure 2 shows the empirical root mean squared error (RMSE) for the whole network on the day of interest. RMSE is defined as, The RMSE time average for the optimal sampling scheme is packets per time slot, and packets per time slot for the naïve one. This corresponds to a error reduction.

Figure 4: Long flow (4 hops), low volume.

We also examine traffic estimation for individual flows. Figures 3(a)3(c) present the cases for the three largest flows in terms of average traffic volume size, namely flows , and . Moreover, Figure 4 illustrates the estimation outcome for flow , which is a “long” flow traversing links, but with relatively low traffic volume. Similarly, Figure 5, depicts the results for flow , a “short” flow with low traffic volume. Clearly, the proposed approached is advantageous over the simplistic sampling scheme.

The results indicate the performance gains of our sampling scheme, being a result of considering both temporal and spatial correlation between flows. A necessary requirement, though, is the stationarity of traffic volumes. This does not always hold for Internet traffic. Ongoing work includes investigation of “richer” stochastic models, something that would allow sampling designs with even stricter sampling constraints (e.g., or even ). Furthermore, one can additionally re-calibrate the model and “learn” its new parameters by increasing the frequency of the training periods (step 1 of Algorithm 1).

Figure 5: Short flow (1 hop), low volume.


  • [1] D. P. Bertsekas and J. N. Tsitsiklis. Neuro Dynamic Programming. Athena Scientific, 1996.
  • [2] S. Boyd and L. Vandenberghe. Convex Optimization. Cambridge University Press, 2004.
  • [3] P. J. Brockwell and R. A. Davis. Time series: theory and methods. Springer-Verlag New York, Inc., New York, NY, USA, 1986.
  • [4] D. Chua, E. Kolaczyk, and M. Crovella. Network kriging. Selected Areas in Communications, IEEE Journal on, 24(12):2263 –2272, dec. 2006.
  • [5] K. C. Claffy, G. C. Polyzos, and H.-W. Braun. Application of sampling methodologies to network traffic characterization. SIGCOMM Comput. Commun. Rev., 23(4):194–203, Oct. 1993.
  • [6] M. Coates, Y. Pointurier, and M. Rabbat. Compressed network monitoring for IP and all-optical networks. In Proc. 7th ACM SIGCOMM, pages 241–252. ACM, 2007.
  • [7] E. Cohen, G. Cormode, and N. Duffield. Don’t let the negatives bring you down: sampling from streams of signed updates. In SIGMETRICS ’12, pages 343–354, New York, NY, USA, 2012. ACM.
  • [8] E. Cohen, N. Duffield, H. Kaplan, C. Lund, and M. Thorup. Algorithms and estimators for accurate summarization of internet traffic. In IMC 2007, pages 265–278, NY, 2007. ACM.
  • [9] N. Duffield. Fair sampling across network flow measurements. SIGMETRICS Perform. Eval. Rev., 40(1):367–378, June 2012.
  • [10] N. Duffield, C. Lund, and M. Thorup. Properties and prediction of flow statistics from sampled packet streams. In In Proc. ACM SIGCOMM Internet Measurement, pages 159–171, 2002.
  • [11] N. Duffield, C. Lund, and M. Thorup. Flow sampling under hard resource constraints. In SIGMETRICS 2004, pages 85–96, NY, 2004.
  • [12] N. Duffield, C. Lund, and M. Thorup. Estimating flow distributions from sampled flow statistics. IEEE/ACM Trans. Net., 13(5):933–946, Oct. ’05.
  • [13] N. Duffield, C. Lund, and M. Thorup. Learn more, sample less: control of volume and variance in network measurement. Information Theory, IEEE Trans, on, 51(5):1756 – 1775, may 2005.
  • [14] N. Duffield, C. Lund, and M. Thorup. Optimal combination of sampled network measurements. In IMC 2005, pages 8–8, Berkeley, CA, USA, 2005. USENIX Association.
  • [15] R. Horst, P. M. Pardalos, and N. V. Thoai. Introduction to Global Optimization. Kluwer Academic Publishers, The Netherlands, 1995.
  • [16] Internet2. http://www.internet2.edu/observatory/.
  • [17] R. E. Kalman. A New Approach to Linear Filtering and Prediction Problems. Transactions of the ASME, Journal of Basic Engineering, (82 (Series D)):35–45, 1960.
  • [18] P. R. Kumar and P. Varaiya. Stochastic systems: estimation, identification and adaptive control. Prentice-Hall, Inc., NJ, USA, 1986.
  • [19] A. Lakhina, M. Crovella, and C. Diot. Diagnosing network-wide traffic anomalies. SIGCOMM Comp. Comm. Rev., 34:219–230, Aug. 2004.
  • [20] M. Lee, N. Duffield, and R. Kompella. Opportunistic flow-level latency estimation using consistent netflow. Networking, IEEE/ACM Transactions on, 20(1):139 –152, feb. 2012.
  • [21] A. Medina, N. Taft, K. Salamatian, S. Bhattacharyya, and C. Diot. Traffic matrix estimation: existing techniques and new directions. In SIGCOMM ’02, pages 161–174, NY, 2002.
  • [22] I. Meier, L., J. Peschon, and R. Dressler. Optimal control of measurement subsystems. Automatic Control, IEEE Trans. on, 12(5):528 –536, Oct ’67.
  • [23] K. Papagiannaki, N. Taft, and A. Lakhina. A distributed approach to measure ip traffic matrices. In IMC 2004, pages 161–174, NY, 2004.
  • [24] W. B. Powell. Approximate Dynamic Programming. John Wiley and Sons, Inc., 2007.
  • [25] H. Robbins. Some Aspects of the Sequential Design of Experiments. Bulletin of the American Mathematical Society, 58(5):527–535, Sept. 1952.
  • [26] H. Singhal and G. Michailidis. Optimal sampling in state space models with applications to network monitoring. In Proceedings of the 2008 ACM SIGMETRICS, pages 145–156, 2008.
  • [27] A. Soule, A. Lakhina, N. Taft, K. Papagiannaki, K. Salamatian, A. Nucci, M. Crovella, and C. Diot. Traffic matrices: balancing measurements, inference and modeling. In 2005 ACM SIGMETRICS, pages 362–373, New York, NY, USA, 2005. ACM.
  • [28] S. Stoev, G. Michailidis, and J. Vaughan. On global modeling of network traffic. Technical report, University of Michigan, 2010. http://www.stat.lsa.umich.edu/sstoev/global_tr.pdf.
  • [29] N. V. Thoai and H. Tuy. Convergent algorithms for minimizing a concave function. Mathematics of Operations Research, 5(4):pp. 556–566, 1980.
  • [30] H. Witsenhausen. Separation of estimation and control for discrete time systems. Proceedings of the IEEE, 59(11):1557 – 1566, nov. 1971.
  • [31] L. Yang and G. Michailidis. Sampled based estimation of network traffic flow characteristics. In INFOCOM ’07., pages 1775 –1783, May 2007.
  • [32] Y. Zhang, M. Roughan, C. Lund, and D. Donoho. An information-theoretic approach to traffic matrix estimation. In SIGCOMM 2003, pages 301–312, New York, NY, USA, 2003. ACM.