skip to main content
10.1145/1028788.1028805acmconferencesArticle/Chapter ViewAbstractPublication PagesimcConference Proceedingsconference-collections
Article

Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification

Published:25 October 2004Publication History

ABSTRACT

The ability to provide different Quality of Service (QoS) guarantees to traffic from different applications is a highly desired feature for many IP network operators, particularly for enterprise networks. Although various mechanisms exist for providing QoS in the network, QoS is yet to be widely deployed. We believe that a key factor holding back widespread QoS adoption is the absence of suitable methodologies/processes for appropriately mapping the traffic from different applications to different QoS classes. This is a challenging task, because many enterprise network operators who are interested in QoS do not know all the applications running on their network, and furthermore, over recent years port-based application classification has become problematic. We argue that measurement based automated Class of Service (CoS) mapping is an important practical problem that needs to be studied.

In this paper we describe the requirements and associated challenges, and outline a solution framework for measurement based classification of traffic for QoS based on statistical application signatures. In our approach the signatures are chosen in such as way as to make them insensitive to the particular application layer protocol, but rather to determine the way in which an application is used -- for instance is it used interactively, or for bulk-data transport. The resulting application signature can then be used to derive the network layer signatures required to determine the CoS class for individual IP datagrams. Our evaluations using traffic traces from a variety of network locations, demonstrate the feasibility and potential of the approach.

References

  1. M. Allman, V. Paxson, and W. Stevens. TCP congestion control. IETF Network Working Group RFC 2581, 1999.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  2. J. Almeida, J. Krueger, D. Eager, and M. Vernon. Analysis of educational media server workloads. In Proc. Inter. Workshop on Network and Operating System Support for Digital Audio and Video, June 2001.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  3. E. Altman, K. Avrachenkov, and C. Barakat. A stochastic model of TCP/IP with stationary random losses. In SIGCOMM'2000, 2000.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  4. P. Barford and M. Crovella. Generating Representative Web Workloads for Network and Server Performance Evaluation. In Proceedings of ACM Sigmetrics, June 1998.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  5. P. Barford, J. Kline, D. Plonka, and A. Ron. A Signal Analysis of Network Traffic Anomalies. In Proceedings of ACM SIGCOMM Internet Measurement Workshop, Nov 2002.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  6. P. Barford and D. Plonka. Characteristics of Network Traffic Flow Anomalies. In Proceedings of ACM SIGCOMM Internet Measurement Workshop, Oct 2001.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  7. Y. Bernet, J. Binder, S. Blake, M. Carlson, B. Carpenter, S. Keshav, E. Davies, B. Ohlman, Z. Wang, and W. Weiss. A framework for differentiated services. Internet Draft, February 1999. http://search.ietf.org/internet-drafts/draft-ietf-diffserv-framework-02.txt.]]Google ScholarGoogle Scholar
  8. S. Blake, D. Black, D. Black, H. Schulzrinne, D. Black, M. Carlson, E. Davies, Z. Wang, and W. Weiss. Rfc 2475 - an architecture for differentiated service, December 1998. Available at http://www.faqs.org/rfcs/rfc2475.html.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  9. M. Chesire, A. Wolman, G. M. Voelker, and H. M. Levy. Measurement and analysis of a streaming media workload. In Proc. USENIX Symposium on Internet Technologies and Systems, March 2001.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  10. K. Claffy. Internet traffic characterization. PhD thesis, UC San Diego, 1994.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  11. C. Cranor, T. Johnson, and O. Spatscheck. Gigascope: a stream database for network applications. In SIGMOD, June 2003.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  12. C. Dewes, A. Wichmann, and A. Feldmann. An analysis of Internet chat systems. In Proceedings of ACM SIGCOMM Internet Measurement Conference, Oct 2003.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  13. C. Estan, S. Savage, and G. Varghese. Automatically inferring patterns of resource consumption in network traffic. In ACM SIGCOMM, Karlsruhe, Germany, 2003.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  14. K. Fall and S. Floyd. Simulation-based comparisons of Tahoe, Reno, and SACK TCP. Computer Communication Review, 26(3):5--21, 1996. Available at http://www.aciri.org/floyd/papers.html.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  15. A. Feldmann, A. Gilbert, and W. Willinger. Data networks as cascades: Explaining the multifractal nature of internet WAN traffic. In Proceedings of the ACM Sigcomm'98, Vancouver, Canada, 1998.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  16. S. Floyd. Connections with multiple congested gateways in packet-switched networks, part I: One way traffic. Computer Communications Review, 21(5), 1991.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  17. C. Gbaguidi, H. Einsiedler, P. Hurley, W. Almesberger, and J. P. Hubaux. A survey of differentiated services architectures for the Internet, March 1998. http://sscwww.epfl.ch/Pages/publications/ps_files/tr98_020.ps.]]Google ScholarGoogle Scholar
  18. A. C. Gilbert, S. Guha, P. Indyk, Y. Kotidis, S. Muthukrishnan, and M. J. Strauss. Fast, small-space algorithms for approximate histogram maintenance. In STOC, 2002.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  19. T. Hastie, R. Tibshirani, and J. Friedman. The Elements of Statistical Learning: Data Mining, Inference and Prediction. Springer, 2001.]]Google ScholarGoogle Scholar
  20. IANA. Internet Assigned Numbers Authority (IANA). http://www.iana.org/assignments/port-numbers.]]Google ScholarGoogle Scholar
  21. V. Jacobson. Congestion avoidance and control. Communication Review, 18(4):314--329, 1988. Available at ftp://ftp.ee.lbl.gov/papers/congavoid.ps.Z.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  22. B. Krishnamurthy and J. Rexford. Web Protocols and Practice, chapter Chapter 10: Web Workload Characterization. Addison-Wesley, 2001.]]Google ScholarGoogle Scholar
  23. Z. Liu, M. S. Squillante, C. H. Xia, S. zheng Yu, and L. Zhang. Profile-based traffic chacterization of commercial web sites. In J.Charzinski, R.Lehnert, and P.Tan-Gia, editors, Proceedings of the 18th International Teletraffic Congress (ITC-18), volume 5a, pages 231--240, Berlin, Germany, 2003.]]Google ScholarGoogle Scholar
  24. M. Mathis, J. Semke, J. Mahdavi, and T. Ott. The macroscopic behavior of the TCP congestion avoidance algorithm. Computer Communication Review, 27(3):67--82, July 1997. Available at http://www.psc.edu/networking/tcp_friendly.html#performance.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  25. J. Micheel, I. Graham, and N. Brownlee. The A uckland data set: an access link observed. In the 14th ITC Specialist Seminar on Access Networks and Systems, Barcelona, Spain, April 25th-27th 2001.]]Google ScholarGoogle Scholar
  26. D. Moore, G. Voelker, and S. Savage. Inferring Internet Denial of Service Activity. In Proc. of the USENIX Security Symposium, Washington D.C., August 2001. Available at http://www.cs.ucsd.edu/ savage/papers/UsenixSec01.pdf.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  27. White paper-netflow services and applications. http://www.cisco.com/warp/public/cc/pd/iosw/ioft/neflct/tech/napps_ wp.htm.]]Google ScholarGoogle Scholar
  28. J. Padhye, V. Firoin, D. Towsley, and J. Kurose. Modeling TCP throughput: A simple model and its empirical validation. In ACM SIGCOMM'98, 1998. Available at http://www.psc.edu/networking/tcp_friendly.html#performance.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  29. V. Paxson. Empirically derived analytic models of wide-area TCP connections. IEEE/ACM Transactions on Networking, 2(4):316--336, 1994.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  30. V. Paxson and S. Floyd. Wide-area traffic: The failure of Poisson modeling. IEEE/ACM Transactions on Networking, 3(3):226--244, June 1995.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  31. J. E. Pitkow. Summary of WWW characterizations. W3J, 2:3--13, 1999.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  32. H. Schulzrinne, A. Rao, and R. Lanphier. Real time streaming protocol (RTSP), request for comments 2326, April 1998. ftp://ftp.isi.edu/in-notes/rfc2326.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  33. J. Tukey and P. Tukey. Strips displaying empirical distributions: I. textured dot strips. Technical report, Bellcore Technical Memorandum, 1990.]]Google ScholarGoogle Scholar
  34. J. van der Merwe, S. Sen, and C. Kalmanek. Streaming video traffic: Characterization and network impact. In 7th International Web Content Caching and Distribution workshop (WCW), Boulder, Colorado, August 14th-16th 2002.]]Google ScholarGoogle Scholar
  35. W. Willinger, M. S. Taqqu, R. Sherman, and D. V. Wilson. Self-similarity through high-variability: Statistical analysis of Ethernet LAN traffic at the source level. Proceedings of the ACM SIGCOMM'95, 1995. Available at http://www.acm.org/sigcomm/sigcomm95/sigcpapers.html.]] Google ScholarGoogle ScholarDigital LibraryDigital Library
  36. Y. Zhang and V. Paxson. Detecting backdoors. In Proc. USENIX, Denver, Colorado, USA, 2000.]] Google ScholarGoogle ScholarDigital LibraryDigital Library

Index Terms

  1. Class-of-service mapping for QoS: a statistical signature-based approach to IP traffic classification

      Recommendations

      Comments

      Login options

      Check if you have access through your login credentials or your institution to get full access on this article.

      Sign in
      • Published in

        cover image ACM Conferences
        IMC '04: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
        October 2004
        386 pages
        ISBN:1581138210
        DOI:10.1145/1028788

        Copyright © 2004 ACM

        Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

        Publisher

        Association for Computing Machinery

        New York, NY, United States

        Publication History

        • Published: 25 October 2004

        Permissions

        Request permissions about this article.

        Request Permissions

        Check for updates

        Qualifiers

        • Article

        Acceptance Rates

        Overall Acceptance Rate277of1,083submissions,26%

        Upcoming Conference

        IMC '24
        ACM Internet Measurement Conference
        November 4 - 6, 2024
        Madrid , AA , Spain

      PDF Format

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader