Periodicity-Based Anomalies in Self-Similar Network Traffic Flow Measurements

Abstract

Network traffic flow measurement is fundamental in timely monitoring computer networks and in diagnosing potential anomalies. Previous measurement studies have shown that network traffic flows are often self-similar. The degree of self-similarity is described by the Hurst parameter H. In the literature, various methods have been used in estimating H, while their performances have not been evaluated for network traces that contain periodicity-based anomalies. In this paper, we investigate the performance of well-known estimators for traffic flow measurements with periodicity-based anomalies. We derive analytical expressions for widely used estimation methods in time, frequency, wavelet, and eigen domains and demonstrate through simulations that periodicity-based anomalies affect Hurst parameter estimation, causing unreliable H estimates. We show that our theoretical and experimental results are consistent with the observations of real network traffic flow measurements.