We will review some of the major results in random graphs and some of the more challenging open problems. We will cover algorithmic and structural questions. We will touch on newer models, including those related to the WWW.

Random graphs

The notion of self-similarity has been shown to apply to wide-area and local-area network traffic. We show evidence that the subset of network traffic that is due to World Wide Web (WWW) transfers can show characteristics that are consistent with self-similarity, and we present a hypothesized explanation for that self-similarity. Using a set of traces of actual user executions of NCSA Mosaic, we examine the dependence structure of WWW traffic. First, we show evidence that WWW traffic exhibits behavior that is consistent with self-similar traffic models. Then we show that the self-similarity in such traffic can be explained based on the underlying distributions of WWW document sizes, the effects of caching and user preference in file transfer, the effect of user "think time", and the superimposition of many such transfers in a local-area network. To do this, we rely on empirically measured distributions both from client traces and from data independently collected at WWW servers.

/pdf/self-similarity-in-world-wide-web-traffic-evidence-and-5boev1op7z.pdf

Self-similarity in World Wide Web traffic: evidence and possible causes

Recently the notion of self-similarity has been shown to apply to wide-area and local-area network traffic. In this paper we examine the mechanisms that give rise to the self-similarity of network traffic. We present a hypothesized explanation for the possible self-similarity of traffic by using a particular subset of wide area traffic: traffic due to the World Wide Web (WWW). Using an extensive set of traces of actual user executions of NCSA Mosaic, reflecting over half a million requests for WWW documents, we examine the dependence structure of WWW traffic. While our measurements are not conclusive, we show evidence that WWW traffic exhibits behavior that is consistent with self-similar traffic models. Then we show that the self-similarity in such traffic can be explained based on the underlying distributions of WWW document sizes, the effects of caching and user preference in file transfer, the effect of user "think time", and the superimposition of many such transfers in a local area network. To do this we rely on empirically measured distributions both from our traces and from data independently collected at over thirty WWW sites.

/pdf/self-similarity-in-world-wide-web-traffic-evidence-and-4olkshqr0k.pdf

What determines the timing of human actions? A big question, but the science of human dynamics is here to tackle it. And its predictions are of practical value: for example, when ISPs decide what bandwidth an institution needs, they use a model of the likely timing and activity level of the individuals. Current models assume that an individual has a well defined probability of engaging in a specific action at a given moment, but evidence that the timing of human actions does not follow this pattern (of Poisson statistics) is emerging. Instead the delay between two consecutive events is best described by a heavy-tailed (power law) distribution. Albert-Laszlo Barabasi proposes an explanation for the prevalence of this behaviour. The ‘bursty’ nature of human dynamics, he finds, is a fundamental consequence of decision making. The dynamics of many social, technological and economic phenomena are driven by individual human actions, turning the quantitative understanding of human behaviour into a central question of modern science. Current models of human dynamics, used from risk assessment to communications, assume that human actions are randomly distributed in time and thus well approximated by Poisson processes1,2,3. In contrast, there is increasing evidence that the timing of many human activities, ranging from communication to entertainment and work patterns, follow non-Poisson statistics, characterized by bursts of rapidly occurring events separated by long periods of inactivity4,5,6,7,8. Here I show that the bursty nature of human behaviour is a consequence of a decision-based queuing process9,10: when individuals execute tasks based on some perceived priority, the timing of the tasks will be heavy tailed, with most tasks being rapidly executed, whereas a few experience very long waiting times. In contrast, random or priority blind execution is well approximated by uniform inter-event statistics. These finding have important implications, ranging from resource management to service allocation, in both communications and retail.

The origin of bursts and heavy tails in human dynamics

Series Preface * Preface to the Third Edition * 1 Linear Systems * 2 Nonlinear Systems: Local Theory * 3 Nonlinear Systems: Global Theory * 4 Nonlinear Systems: Bifurcation Theory * References * Index

/pdf/differential-equations-and-dynamical-systems-3chsjx2k45.pdf

Differential Equations and Dynamical Systems

Self-Similar Network Traffic: An Overview (K. Park & W. Willinger). Wavelets for the Analysis, Estimation, and Synthesis of Scaling Data (P. Abry, et al.). Simulations with Heavy-Tailed Workloads (M. Crovella & L. Lipsky). Queueing Behavior Under Fractional Brownian Traffic (I. Norros). Heavy Load Queueing Analysis with LRD On/Off Sources (F. Brichet, et al.). The Single Server Queue: Heavy Tails and Heavy Traffic (O. Boxma & J. Cohen). Fluid Queues, On/Off Processes, and Teletraffic Modeling with Highly Variable and Correlated Inputs (S. Resnick & G. Samorodnitsky). Bounds on the Buffer Occupancy Probability with Self-Similar Input Traffic (N. Likhanov). Buffer Asymptotics for M/G/ Input Processes (A. Makowski & M. Parulekar). Asymptotic Analysis of Queues with Subexponential Arrival Processes (P. Jelenkovi). Traffic and Queueing from an Unbounded Set of Independent Memoryless On/Off Sources (P. Jacquet). Long-Range Dependence and Queueing Effects for VBR Video (D. Heyman & T. Lakshman). Analysis of Transient Loss Performance Impact of Long-Range Dependence in Network Traffic (G.-L. Li & V. Li). The Protocol Stack and Its Modulating Effect on Self-Similar Traffic (K. Park, et al.). Characteristics of TCP Connection Arrivals (A. Feldmann). Engineering for Quality of Service (J. Roberts). Network Design and Control Using On/Off and Multilevel Source Traffic Models with Heavy-Tailed Distributions (N. Duffield & W. Whitt). Congestion Control for Self-Similar Network Traffic (T. Tuan & K. Park). Quality of Service Provisioning for Long-Range-Dependent Real-Time Traffic (A. Adas & A. Mukherjhee). Toward an Improved Understanding of Network Traffic Dynamics (R. Riedi & W. Willinger). Future Directions and Open Problems in Performance Evaluation and Control of Self-Similar Network Traffic (K. Park). Index.

Self-Similar Network Traffic and Performance Evaluation

Denial of service (DoS) attack on the Internet has become a pressing problem. In this paper, we describe and evaluate route-based distributed packet filtering (DPF), a novel approach to distributed DoS (DDoS) attack prevention. We show that DPF achieves proactiveness and scalability, and we show that there is an intimate relationship between the effectiveness of DPF at mitigating DDoS attack and power-law network topology.The salient features of this work are two-fold. First, we show that DPF is able to proactively filter out a significant fraction of spoofed packet flows and prevent attack packets from reaching their targets in the first place. The IP flows that cannot be proactively curtailed are extremely sparse so that their origin can be localized---i.e., IP traceback---to within a small, constant number of candidate sites. We show that the two proactive and reactive performance effects can be achieved by implementing route-based filtering on less than 20% of Internet autonomous system (AS) sites. Second, we show that the two complementary performance measures are dependent on the properties of the underlying AS graph. In particular, we show that the power-law structure of Internet AS topology leads to connectivity properties which are crucial in facilitating the observed performance effects.

https://ccs.korea.ac.kr/pds/SIGCOMM01.pdf

On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets

Measurements of LAN and WAN traffic show that network traffic exhibits variability on different scales. We examine a mechanism that gives rise to self-similar network traffic and discuss performance. The mechanism we study is the transfer of files or messages whose size is drawn from a heavy-tailed distribution. In a realistic client/server network the degree to which file sizes are heavy-tailed can directly determine the degree of traffic self-similarity at the link level. This causal relationship is robust relative to changes in network resources, network topology, the influence of cross-traffic, and the distribution of interarrival times. Properties of the transport layer play an important role in preserving and modulating this relationship. The reliable transmission and flow control mechanisms of TCP serve to maintain the long-range dependency structure induced by heavy-tailed file size distributions. In contrast, if a non-flow-controlled and unreliable (UDP-based) transport protocol is used, the resulting traffic shows little self-similarity: although still bursty at short time scales, it has little long-range dependence. Performance implications of self-similarity are discussed as represented by various performance measures. Increased self-similarity as expected, results in degradation of performance. Queueing delay, in particular is discussed. Throughput-related measures such as packet loss and retransmission rate, however increase only gradually with increasing traffic self-similarity as long as reliable, flow-controlled transport protocol is used.

/pdf/on-the-relationship-between-file-sizes-transport-protocols-ze5ja0r4l5.pdf

On the relationship between file sizes, transport protocols, and self-similar network traffic

Effective mitigation of denial of service (DoS) attack is a pressing problem on the Internet. In many instances, DoS attacks can be prevented if the spoofed source IP address is traced back to its origin which allows assigning penalties to the offending party or isolating the compromised hosts and domains from the rest of the network. IP traceback mechanisms based on probabilistic packet marking (PPM) have been proposed for achieving traceback of DoS attacks. We show that probabilistic packet marking-of interest due to its efficiency and implementability vis-a-vis deterministic packet marking and logging or messaging based schemes-suffers under spoofing of the marking field in the IP header by the attacker which can impede traceback by the victim. We show that there is a trade-off between the ability of the victim to localize the attacker and the severity of the DoS attack, which is represented as a function of the marking probability, path length, and traffic volume. The optimal decision problem-the victim can choose the marking probability whereas the attacker can choose the spoofed marking value, source address, and attack volume-can be expressed as a constrained minimax optimization problem, where the victim chooses the marking probability such that the number of forgeable attack paths is minimized. We show that the attacker's ability to hide his location is curtailed by increasing the marking probability, however, the latter is upper-bounded due to sampling constraints. In typical IP internets, the attacker's address can be localized to within 2-5 equally likely sites which renders PPM effective against single source attacks. Under distributed DoS attacks, the uncertainty achievable by the attacker can be amplified, which diminishes the effectiveness of PPM.

/pdf/on-the-effectiveness-of-probabilistic-packet-marking-for-ip-2c437kgvp1.pdf

On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack

/pdf/self-similar-network-traffic-an-overview-4oxn2b9ef7.pdf

Kihong Park

Papers

Self-Similar Network Traffic and Performance Evaluation

On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets

On the relationship between file sizes, transport protocols, and self-similar network traffic

On the effectiveness of probabilistic packet marking for IP traceback under denial of service attack

Self‐Similar Network Traffic: An Overview