Internet Traffic Volumes Are Not Gaussian – They Are Log-Normal: An 18-Year Longitudinal Study With Implications for Modelling and Prediction

by   Mohammed Alasmar, et al.

Getting good statistical models of traffic on network links is a well-known, often-studied problem. A lot of attention has been given to correlation patterns and flow duration. The distribution of the amount of traffic per unit time is an equally important but less studied problem. We study a large number of traffic traces from many different networks including academic, commercial and residential networks using state-of-the-art statistical techniques. We show that traffic obeys the log-normal distribution which is a better fit than the Gaussian distribution commonly claimed in the literature. We also investigate an alternative heavy-tailed distribution (the Weibull) and show that its performance is better than Gaussian but worse than log-normal. We examine anomalous traces which exhibit a poor fit for all distributions tried and show that this is often due to traffic outages or links that hit maximum capacity. We demonstrate that the data we look at is stationary if we consider samples of 15 minutes or even one hour long. This gives confidence that we can use the distributions for estimation and modelling purposes. We demonstrate the utility of our findings in two contexts: predicting that the proportion of time traffic will exceed a given level (for service level agreement or link capacity estimation) and predicting 95th percentile pricing. We also show that the log-normal distribution is a better predictor than Gaussian or Weibull distributions in both contexts.



There are no comments yet.


page 1

page 7

page 8

page 9

page 11


On the Distribution of Traffic Volumes in the Internet and its Implications

Getting good statistical models of traffic on network links is a well-kn...

Multivariate Log-Skewed Distributions with normal kernel and their Applications

We introduce two classes of multivariate log skewed distributions with n...

A useful family of fat-tailed distributions

It is argued that there is a need for fat-tailed distributions that beco...

Hyperbolic normal stochastic volatility model

For option pricing models and heavy-tailed distributions, this study pro...

A note on the Lomax distribution

The Lomax distribution is a popularly used heavy-tailed distribution tha...

Detecting Target-Area Link-Flooding DDoS Attacks using Traffic Analysis and Supervised Learning

A novel class of extreme link-flooding DDoS (Distributed Denial of Servi...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.