Evaluating the impact of traffic sampling in network analysis

Universidade do Minho Escola de Engenharia Departamento de Informática João Emanuel da Silva Mendes Evaluating the impact of traffic sampling in network analysis February 2022 Universidade do Minho Escola de Engenharia Departamento de Informática João Emanuel da Silva Mendes Evaluating the impact of traffic sampling in network analysis Integrated Master’s dissertation Integrated Master’s in Informatics Engineering Dissertation supervised by Solange Rito Lima João Marco Cardoso da Silva February 2022 i AUTHOR COPYRIGHTS AND TERMS OF USAGE BY THIRD PARTIES This is an academic work which can be utilized by third parties given that the rules and good practices internationally accepted, regarding author copyrights and related copyrights. Therefore, the present work can be utilized according to the terms provided in the license bellow. If the user needs permission to use the work in conditions not foreseen by the licensing indicated, the user should contact the author, through the RepositóriUM of University of Minho. License provided to the users of this work Attribution-NonCommercial CC BY-NC https://creativecommons.org/licenses/by-nc/4.0/ ii STATEMENT OF INTEGRITY I hereby declare having conducted this academic work with integrity. I confirm that I have not used plagiarism or any form of undue use of information or falsification of results along the process leading to its elaboration. I further declare that I have fully acknowledged the Code of Ethical Conduct of the University of Minho. Insert name ABSTRACT The sampling of network traffic is a very effective method in order to comprehend the behaviour and flow of a network, essential to build network management tools to control Service Level Agreements (SLAs), Quality of Service (QoS), traffic engineering, and the planning of both the capacity and the safety of the network. With the exponential rise of the amount traffic caused by the number of devices connected to the Internet growing, it gets increasingly harder and more expensive to understand the behaviour of a network through the analysis of the total volume of traffic. The use of sampling techniques, or selective analysis, which consists in the election of small number of packets in order to estimate the expected behaviour of a network, then becomes essential. Even though these techniques drastically reduce the amount of data to be analyzed, the fact that the sampling analysis tasks have to be performed in the network equipment can cause a significant impact in the performance of these equipment devices, and a reduction in the accuracy of the estimation of network state. In this dissertation project, an evaluation of the impact of selective analysis of network traffic will be explored, at a level of performance in estimating network state, and statistical properties such as self-similarity and Long-Range Dependence (LRD) that exist in original network traffic, allowing a better understanding of the behaviour of sampled network traffic. Keywords: Sampling, Quality of Service, Long-Range Dependence iii RESUMO A análise seletiva do tráfego de rede é um método muito eficaz para a compreensão do comportamento e fluxo de uma rede, sendo essencial para apoiar ferramentas de gestão de tarefas tais como o cumprimento de contratos de serviço (Service Level Agreements - SLAs), o controlo da Qualidade de Serviço (QoS), a engenharia de tráfego, o planeamento de capacidade e a segurança das redes. Neste sentido, e face ao exponencial aumento da quantidade de tráfego presente causado pelo número de dispositivos com ligação à rede ser cada vez maior, torna-se cada vez mais complicado e dispendioso o entendimento do comportamento de uma rede através da análise do volume total de tráfego. A utilização de técnicas de amostragem, ou análise seletiva, que consiste na eleição de um pequeno conjunto de pacotes de forma a tentar estimar, ou calcular, o comportamento expectável de uma rede, torna-se assim essencial. Apesar de estas técnicas reduzirem bastante o volume de dados a ser analisado, o facto de as tarefas de análise seletiva terem de ser efetuadas nos equipamentos de rede pode criar um impacto significativo no desempenho dos mesmos e uma redução de acurácia na estimação do estado da rede. Nesta dissertação de mestrado será então feita uma avaliação do impacto da análise seletiva do tráfego de rede, a nível do desempenho na estimativa do estado da rede e a nível das propriedades estatísticas tais como a Long-Range Dependence (LRD) existente no tráfego original, permitindo assim entender melhor o comportamento do tráfego de rede seletivo. Keywords: Análise seletiva, Qualidade de Serviço, Long-Range Dependence iv CONTENTS 1 introduction 1 1.1Motivation and Objectives 1 1.2Research Methodology 2 1.3Dissertation Layout 2 2 state of art 4 2.1Sampling 4 2.1.1Sampling Techniques 4 2.1.2Traffic Flow Analysis through Sampling 6 2.1.3Comparison of Sampling Techniques 7 2.2Properties of Internet Traffic 11 2.2.1Self-Similarity and Long Range Dependence 12 2.2.2Methods for estimating LRD parameters H and γ13 2.2.3Estimation Accuracy Evaluation 15 2.2.4Autocorrelation function 19 3 development 21 3.1Sampling Framework 21 3.2Sampling Commands 23 3.3Data Sets Used 23 3.3.1OC48 23 3.3.2OC192 24 3.4Data Set Filtering 25 3.4.1Mergecap 25 3.4.2Wireshark 25 3.4.3Editcap 27 3.4.4TShark 29 3.5Normalizing Data Sets 31 3.6Algorithms Used 32 3.6.1Aggregate variance 32 3.6.2R/S 33 3.6.3Periodogram 34 3.7Selfis 35 4 test and result analysis 37 4.1OC-48 37 4.1.1Basic Statistics 37 v contents vi 4.1.2Aggregate Variance 42 4.1.3R/S 43 4.1.4Periodogram 44 4.2OC-192 46 4.2.1Basic Statistics 46 4.2.2Aggregate Variance 49 4.2.3R/S 50 4.2.4Periodogram 51 4.2.5Autocorrelation Function 52 4.3Summary 55 4.3.1Data Volume 56 4.3.2Throughput and Hurst Estimations 56 5 conclusion 58 5.1Future Work 58 LIST OF FIGURES Figure 1Example of sampling techniques [1]5 Figure 2Framework design [1]7 Figure 3Volume of data [1]9 Figure 4Dispersion of estimated throughput - moderate workload [1]11 Figure 5 Absolute estimation error of H attained by six methods (N=131072, mean, standard deviation and min-max excursion out of 100 samples) [2]17 Figure 6 Absolute estimation error of H attained by six methods (N=1024, mean, standard deviation and min-max excursion out of 100 samples) [2]18 Figure 7 Average mean E[m△i] and standard deviation E[σ△i] (i=0,. . . ,10) of the H estimation errors attained by five methods (R(1) out of scale, average results on 100 pseudo-random sequences for each of 11 values Hi) [2]19 Figure 8Sampler4Framework 22 Figure 9Download command using the aria2c tool 22 Figure 10 Merging multiple pcap files to output oc192fulldata set.pcap 25 Figure 11 Wireshark OC192 5s time series I/O packets graph - 0.1s time frame 26 Figure 12 Wireshark OC192 5s time series I/O packets graph - 0.01s time frame 26 Figure 13 Wireshark OC192 5s time series I/O packets graph - 0.001s time frame 27 Figure 14 Formatting OC192 pcap with editcap -F 29 Figure 15 Formatting full OC192 data set pcap using -F flag to pcapng format 29 Figure 16 Tshark command 0.1s interval 30 Figure 17 Resulting IO statistics 31 Figure 18 OC192 SELFIS Hurst estimation - Aggregate variance 33 Figure 19 OC192 Matlab Hurst estimation - R/S 34 Figure 20 OC192 SELFIS Hurst estimation - Periodogram 35 Figure 21 Example of SELFIS software tool GUI 35 Figure 22 OC48 Original and sampled data sets Boxplot - 0.1s time frame 39 Figure 23 OC48 Original and sampled data sets Boxplot - 0.01s time frame 40 Figure 24 OC48 Original and sampled data sets Boxplot - 0.001s time frame 41 vii 1.3. Dissertation Layout 3 • Chapter 3Development : This chapter presents an explanation of the sampling framework used as well as the decisions that took place, the data sets used, their preparation and the tools used to achieve this, This chapter also contains a description of the algorithms later used for testing and results. • Chapter 4Tests and results : This chapter contains all the results obtained and the corresponding discussion. • Chapter 5Conclusion : This chapter contains the conclusion of the overall work as well as the potential future work as a way to further explore the theme of this dissertation. 2 S TAT E O F A RT This chapter considers the main concepts of sampling, some of the most known sampling techniques and in which way the process differs between each of them, as well as how the sampling techniques can be divided into different components and their comparison in terms of computational weight. Other investigation points are properties of Internet traffic, mainly focused on how traffic can be viewed as a self-similar process and long range dependant, and finally some algorithms and processes to estimate the validity and existence of these properties with real time series. 2.1 sampling The analysis of the total volume of data of Internet traffic in order to model a network and perform accurate traffic classification becomes increasingly taxing on the performance of the network, reducing the overall throughput of such network and making it more likely to bottleneck the network equipment. A way to lighten that burden is by applying sampling techniques on the traffic and subsequent traffic analysis, classification and modeling algorithms, in a substantially smaller volume of data. However, there are different sampling techniques and algorithms, with varying rates of the amount of data collected, computational cost and the ability of accurately representing the network behaviour. 2.1.1Sampling Techniques • Systematic count-based (SystC): Drives the packet selection through a deterministic and invariable function based on the packet position, using counters [ 1 , 16 ]. As exemplified in Fig. 1(a), every 5th packet is selected and captured by the sampling process. • Systematic time-based (SystT): the process of the packet selection follows a deterministic function based on the arrival time at the measurement point [ 1 , 16 ]. In this technique the sample size and the time between samples are set at the beginning and remain unchanged along the sampling process, as presented in Fig. 1(b). As shown, 4 2.1. Sampling 5 all packets arriving at the measurement point along a period of 100ms are selected for a sample, whereas all incoming packets along 200ms are ignored for measurement purposes. • Random count-based (RandC): selects the starting points of the sampling intervals in accordance with a random process. As presented in Fig. 1(c), in the n-out-of-N random approach, n elements are randomly selected out of the parent population that consists of N elements [1,16]. Figure 1: Example of sampling techniques [1] • Adaptive linear prediction: this time-based technique uses linear prediction to identify the network activity, adjusting the sampling frequency accordingly while the sample size remains the same. This technique reduces the interval between samples when the network activity is higher than predicted. Otherwise, when less network activity than predicted is observed, the interval between samples is increased, reducing the sample frequency and, consequently, the amount of data involved in the sample process. • Multiadaptive sampling (MuST): Although this technique is very similar to the adaptive linear prediction technique, the multiadaptive technique considers both the interval between samples and the sample size as adjustable parameters. Apart from increasing the sampling frequency in periods of more activity than predicted, the multiadaptive technique also reduces the sample size, avoiding the overload of the measurement point in a critical scenario of its operation. Conversely, in periods of less activity than predicted, in addition to sampling frequency reduction, the multiadaptive sampling also increases the sample size in order to acquire more information about the 2.1. Sampling 6 network without the risk of overloading the measurement point. This technique, along with SysT achieves a better ratio of volume of data collected by computational cost. 2.1.2Traffic Flow Analysis through Sampling With the increasing importance of accurate traffic classification and characterization based on traffic sampling, the reduction of the burden of traffic analysis is no less important. Current research on this topic is typically focused on identifying the complexity and limitations introduced by the missing data during the analysis of incomplete data traffic or traffic with gaps between data created by the sampling process.[17] However, much of the research on this topic only consider the classic sampling techniques such as systematic count-based or random count-based approaches, which resort to a deterministic or probabilistic function, while more recent techniques such as adaptive sampling or time-based sampling are not covered. Considering IETF PSAMP work [ 16 , 17 ] and recent sampling proposals, a sampling taxonomy is used to identify the inner characteristics distinguishing sampling techniques and help defining new ones which can be adjusted to each traffic/service measurement scenario. The taxonomy defines that sampling techniques can be classified into three welldefined components according to the granularity, selection scheme and selection trigger in use. Then each component is further divided into a set of approaches commonly followed in existing sampling techniques. 1. Granularity - identifies the atomicity of the element under analysis in the sampling process: in flow-level approach, the sampling process is only applied to packets belonging to a specific set of flows of interest; in packet-level approach, packets are eligible as independent entities. 2. Selection scheme - identifies the function defining which traffic packets will be selected and collected; this scheme may follow a systematic approach, in which the process of packet selection is ruled by a deterministic function that imposes a fixed sampling frequency, independently of the packet contents or treatment; a random approach, that rules the sampling frequency through a random process, usually resorting to a pseudo-random generator or to a probabilistic function; or an adaptive approach, in which the sampling technique is endowed with the ability to change the selection of packets during the course of measurements aiming to identify the most important parts of a traffic stream according to the measurement needs or to save network resources during critical periods. 3. Selection trigger - determines the spatial and temporal sample boundaries; it may use a time-based approach, in which the sampling beginning and end are driven based on 2.1. Sampling 7 the packets arrival time at the measurement point; a count-based approach, in which the sampling boundaries are defined based on the packet position in the incoming stream; or an event-based approach, in which the decision on when a sample starts and ends takes into account some particular event observed in the traffic being monitored. This event may be some value in the packet contents, the treatment of the packet at the measurement point or a more complex observation. A framework implemented in Java using Jpcap, connects the sampling components in order to enable a versatile deployment of sampling techniques. This framework is designed in two planes comprising the relationship among the sampling components, as illustrated in Fig. 8, and may be applied to both online and offline measurement scenarios [1]. The sampling plane has a modular design, allowing a flexible sampling technique selection and configuration. This plane is also responsible for identifying and selecting the network interface in which the sampling will be applied. In the network plane, traffic is collected from network interfaces by applying the sample rules defined in the sampling plane. Then the collected packets are reported to be analyzed according to network task measurement needs. Figure 2: Framework design [1] 2.1.3Comparison of Sampling Techniques The traffic scenarios used for this analysis comparison correspond to three workload periods (low, moderate and high) in the network backbone of the University of Minho campus along 2.1. Sampling 8 a typical workday which is then submitted to each sampling technique. The measured values are presented in the following 1. Table 1: Traffic scenarios [1] Workload scenario / Feature Low Moderate High Number of packets 311159 1273068 1718804 Volume of data (MBytes) 112.04 712.99 1063.16 Mean throughput (Mbps) 3.90 26.65 68.79 Mean packet size (Bytes) 377.58 587.26 648.59 Computational Weight The computational weight of each sampling technique is analyzed in terms of hardware resource usage (CPU Load and Memory) and volume of sampling data stored. While resource usage may impact the performance of the measurement point, data volume affects the bandwidth required by measurement data as well as the storage and processing overhead [1,18]. Regarding the volume of data collected and stored along the sampling process, the countbased techniques (SystC and RandC) demonstrate less use of resources, as illustrated in Fig. 3. It also shows that MuST achieves the best results among the time-based techniques. 2.1. Sampling 9 Figure 3: Volume of data [1] Although with higher consumption of storage resources, SysT and MuST achieve a better relationship between the volume of data collected and the computational cost involved. Accuracy Despite the importance of reducing the usage of computational resources associated with traffic sampling, in order to be a useful tool the sampling techniques must still be able to represent the network behavior accurately [ 1 ], A common way to achieve this goal is 2.1. Sampling 10 Table 2: Average use of computational resources [1] Parameter SystC SystT RandC LP MuST Low workload CPU load (%) 5.03 14.55 5.50 27.35 8.82 Memory (kBytes) 76566 95900 81222 82440 85295 Moderate workload CPU load (%) 10.80 17.95 16.86 96.68 10.72 Memory (kBytes) 80773 96410 84042 87698 84371 High workload CPU load (%) 14.92 20.12 18.26 97.27 10.76 Memory (kBytes) 81801 90754 86163 85551 80765 through estimating throughput, which consists in measuring the amount of sampled data in a time interval. Thereby, the accuracy in estimating traffic behavior is analyzed through instantaneous throughput, which is the throughput estimated in each sample along the measurement process, as well as mean throughput, i.e., the total estimated load, and its mean relative error (MRE). In addition, the accuracy in instantaneous throughput estimation is measured using the variance, where a smaller variance means a more accurate estimation. This comparison is performed calculating the mean square error (MSE), a common metric to compare estimators [1,18]. Fig. 4details where each point corresponds to one sample and the values closer to the reference line indicate a lower estimation error and an overall stability of its algorithms. 2.2. Properties of Internet Traffic 11 Figure 4: Dispersion of estimated throughput - moderate workload [1] 2.2 properties of internet traffic Self-similarity and scaling phenomena have dominated backbone Internet traffic analysis for the past decade. With the identification of long-range dependence (LRD) in network traffic, the research community has undergone a paradigm shift from Poisson and memory-less processes to identification of LRD and bursty processes. Despite its widespread use, though, LRD analysis is hindered by the difficulty of actually identifying dependence and estimating its parameters unambiguously [3]. 2.2. Properties of Internet Traffic 12 2.2.1Self-Similarity and Long Range Dependence Packet traffic exhibits intriguing temporal correlation properties, such as self-similarity and long memory (long-range dependence) [2]. Interestingly, if we plot packet or byte traffic arrivals at coarser scales, say every 0.1second, every second, or every 10 seconds, we obtain a rather unexpected result. Instead of smoother and smoother arrival counts as we would expect, we always observe a process that is almost as variable as the one observed at the finer 2scales [19]. This property of the variance in packet or byte arrivals in Internet traffic, which is known as self-similarity or scale-invariance holds true for different time granularities or scales, from a few hundred milliseconds up to hundreds of seconds. In a self-similar random process, a dilated portion of a realization has the same statistical characterization than the whole. “Dilating” is applied on both amplitude and time axes of the sample path, according to a scaling parameter H called Hurst parameter. On the other hand, long-range dependence (LRD) is a long-memory property observed on large time scales. Under some hypotheses, the integral of a LRD process is self-similar with H related to γ (e.g., fractional Brownian motion, integral of fractional Gaussian noise). Over the years a substantial amount of attention has been devoted to designing and perfecting algorithms for estimating parameters H and γ of data sequences supposed LRD. A random process X(t) (say, cumulative packet arrivals in time interval [0, t] ) is said to be self-similar, with scaling parameter of self-similarity or Hurst parameter H>0, H∈Rif X(t) =da−HX(at)(1) for all a>0, where =ddenotes equality of all finite-order distributions [2]. The class of self-similar (SS) processes is usually restricted to that of self-similar processes with stationary increments (SSSI), which are “integral” of a stationary process [2]. H characterizes SS (Self-Similar) processes, but it is often used to label also the LRD increments of SSSI (Self-Similar with stationary increments) processes. For this dissertation it will follow this common custom: the expression “Hurst parameter of a LRD process” (characterized by γ ) denotes actually the parameter H= (γ+1)/2 of its integral SSSI parent process. The predominant way to quantify LRD is through the Hurst exponent, which is a scalar [3], and can not be calculated definitively, only estimated. There are two categories of Hurst exponent estimators: those operating in the time domain, and those operating in frequency or wavelet domain. Despite the Poisson characteristics of packet arrivals, traces and analyses agreed with previous findings, showing that LRD characterizes backbone traffic [2]. 2.2. Properties of Internet Traffic 19 resulted 22% smaller than that of MAVAR, which in turn was 14% smaller than that of LD-3. On short sequences (N=1024), MHVAR-3and MAVAR attained similar confidence, far better than LD-3(mean deviation 54% smaller). This superior performance is even more significant, if we also consider the LD-3estimation bias [17]. MAVAR and MHVAR-3are the most accurate estimators of LRD parameters H and γ in terms of both confidence and bias, among all methods considered in this study. Their computational complexity is comparable to that of other methods, in particular LD, since they can be computed recursively [17,24]. Figure 7: Average mean E[m△i] and standard deviation E[σ△i] (i=0,. . . ,10) of the H estimation errors attained by five methods (R(1) out of scale, average results on 100 pseudo-random sequences for each of 11 values Hi) [2] 2.2.4Autocorrelation function Autocorrelation or ACF is a statistical measure of the relationship between a random variable and itself, depending on the lags used. As it has been previously referred, Longrange dependence measures the memory of a process. Intuitively, distant events in time are correlated. This correlation is captured by the autocorrelation function (ACF). That correlation is calculated as follows: ρ(k) = E[(Xt−µ)(Xt+k−µ)] σ2(15) 2.2. Properties of Internet Traffic 20 The autocorrelation coefficient can range between +1(very high positive correlation) and -1(very high negative correlation). Persistent autocorrelation implies a long memory of the data-generating process or, in other words, statistical dependence between observations separated by a large number of time units [ 30 , 31 ]. In contrast, if a time series has a short memory and is predictable from only its immediate past, autocorrelations decay quickly as the number of intervening observations increases [31]. If a time series shows LRD the ACF slowly decays to zero, while for short range dependence that decay occurs quickly. As explained previously, the strength of the LRD is quantified by the Hurst exponent (H). If the number of H is between 0.5and 1then the series exhibits LRD and the closer the H is to 1, the stronger the dependence of the process is. 3 DEVELOPMENT This chapter approaches the details of the sampling framework used in order to obtain sampled data sets, the location from where the original data sets were downloaded with a brief explanation of the network setup. It also contains a description of all the tools used to manipulate those data sets so they can be worked with, in order to transform the packet capture files into something usable by the sampling framework and the estimation algorithms. Furthermore, there is a description and explanation of the methods used to obtain proper inputs for the throughput and LRD estimation algorithms, referred in this chapter and later used for testing. 3.1 sampling framework This framework consists in a Virtual Machine called Sampler4, imported into Oracle VM VirtualBox. As it was originally developed for a 32 bit environment, the graphical display and some commands are not present and the virtual machine would just freeze and crash. In order to work around this issue you either have to work with a 32 bit machine, or turn the VM on pressing right-ctrl + F2so the graphical display is turned off and the system turns on with the unix bash as follows in Fig. 8. • login : sampling • password : sampler2015 21 3.1. Sampling Framework 22 Figure 8: Sampler4Framework The tool aria2was utilized to download files from CAIDA repository instead of more typical methods like wget as it is more advanced as it supports protocols such as HTTP(S), FTP, SFTP, BitTorrent, and Metalink. aria2can download a file from multiple sources/protocols and tries to utilize your maximum download bandwidth. It also supports downloading a file from HTTP(S)/FTP /SFTP and BitTorrent at the same time, while the data downloaded from HTTP(S)/FTP/SFTP is uploaded to the BitTorrent swarm. Using Metalink chunk checksums, aria2automatically validates chunks of data while downloading a file. Figure 9: Download command using the aria2c tool 3.2. Sampling Commands 23 3.2 sampling commands For the sampling process itself, a Python script was used that automatically applies the different sampling techniques detailed in 2.1.1. The framework can apply these techniques to both online traffic sampling, or offline traffic in the form of pcap files which was the type of traffic used in this dissertation. The following command applies one offline sampling technique using the SamplingFramework4_0taking as input a source pcap, the destination file, the sampling technique which is defined as a number (for example "SystC" corresponds to number 13), the sample size and finally the interval between samples. For OFFLINE Sampling # sudo java -jar SamplingFramework4_0.jar source.pcap Destination_file_without_ extension technique sample_size interval_between_samples Another easier way of sampling, and the one used for obtaining sampled data sets was using the Python script file called OfflineSampligAutomationPython2.py which applies all of the different sampling techniques previously referred with reasonable parameters such as the intervals or time periods between samples to each technique. 3.3 data sets used The following data sets of OC48 and OC192 were downloaded from CAIDA, following their user agreement. In the next subsections an explanation of how these network lines are capable of in terms of speeds, and how they are implemented for backbone traffic connections. 3.3.1OC48 OC-48 is a network line with transmission speeds of up to 2488.32 Mbit/s (payload: 2405.376 Mbit/s (2.405376 Gbit/s); overhead: 82.944 Mbit/s). With relatively low interface prices, with being faster than OC-3and OC-12 connections, and even surpassing gigabit Ethernet, OC-48 connections are used as the backbones of many regional ISPs. Interconnections between large ISPs for purposes of peering or transit are quite common. As of 2005, the only connections in widespread use that surpass OC-48 speeds are OC-192 and 10 Gigabit Ethernet. OC-48 is also used as transmission speed for tributaries from OC-192 nodes in order to optimize card slot utilization where lower speed deployments are used. Dropping at OC-12, 3.3. Data Sets Used 24 OC-3or STS-1speeds are more commonly found on OC-48 terminals, where use of these cards on an OC-192 would not allow for full use of the available bandwidth. The following url contains the OC48 data set used for testing. The CAIDA UCSD Anonymized OC48 Internet Traces 2002-2003 - [2002-08-14], https: //publicdata.caida.org/datasets/passive/passive-oc48/20020814-160000.UTC/pcap/ 3.3.2OC192 OC-192 is a network line with transmission speeds of up to 9953.28 Mbit/s (payload: 9510.912 Mbit/s (9.510912 Gbit/s); overhead: 442.368 Mbit/s). A standardized variant of 10 Gigabit Ethernet (10GbE), called WAN-PHY, is designed to inter-operate with OC-192 transport equipment while the common version of 10GbE is called LAN-PHY (which is not compatible with OC-192 transport equipment in its native form). The naming is somewhat misleading, because both variants can be used on a wide area network. In order to obtain access to the OC192 CAIDA data sets, proper authorization must be first granted, as the dataset is not public unlike the OC48 data sets. To achieve the authorization, an inquiry must first be completed with the proper reasoning for the use of the data sets wanted. After sending it, you should receive an email with the proper authentication parameters usually within a week. The following link contains the OC192 data set used for testing. It contains anonymized passive traffic traces from CAIDA’s passive monitors in 2019. It contains traffic traces from ’equinix-nyc’ high-speed monitor. The CAIDA UCSD Anonymized Internet Traces - [201901-17], https://www.caida.org/catalog/datasets/monitors/passive-equinix-nyc/ Dataset Contents ---------------- - trace files (*.pcap.gz): compressed pcap (tcpdump) format traces - time files (*.times.gz): contains original nanosecond-precision timestamps The nanosecond timestamps in each *.times.gz line up exactly with the packets in the corresponding pcap file (containing timestamps truncated to microsecond precision). - stats files (*.pcap.stats): statistics on the trace, produced by crl_stats (part of the CoralReef suite of tools). - file md5.md5: contains md5 checksums for all files 3.4. Data Set Filtering 25 Traces are named using the following format: {monitor}.{direction}.{start-time}.anon.pcap.gz *monitor: equinix-nyc *direction: dirA / dirB *start-time: time trace began, format: yyyymmdd-hhmmss.UTC 3.4 data set filtering In order to obtain usable data sets as input for the both the sampling framework and the algorithms to calculate basic statistics as well as the Hurst parameter, these following programs were used. 3.4.1Mergecap Mergecap is a program that combines multiple saved capture files into a single output file specified by the -w argument. Mergecap knows how to read pcap and pcapng capture files, including those of tcpdump, Wireshark and other tools that write captures in those formats. By default, Mergecap writes the capture file in pcapng format, and writes all of the packets from the input capture files to the output file. Mergecap is able to detect, read and write the same capture files that are supported by Wireshark. The input files don’t need a specific filename extension; the file format and an optional gzip compression will be automatically detected. Figure 10: Merging multiple pcap files to output oc192fulldata set.pcap This program was used to facilitate the sampling process, as the full data set from CAIDA was split into multiple files, with the use of Mergecap, the files were combined into a single one, ordered by timestamp. 3.4.2Wireshark Wireshark[ 32 ] is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. Wireshark’s native capture file formats are pcapng format and pcap format; it can read and write both formats.. pcap format is also the format used by tcpdump and various other tools; tcpdump, when using 3.4. Data Set Filtering 26 newer versions of the libpcap library, can also read some pcapng files, and, on newer versions of macOS, can read all pcapng files and can write them as well. Figure 11: Wireshark OC192 5s time series I/O packets graph - 0.1s time frame Figure 12: Wireshark OC192 5s time series I/O packets graph - 0.01s time frame 3.4. Data Set Filtering 27 Figure 13: Wireshark OC192 5s time series I/O packets graph - 0.001s time frame Even though Wireshark has the possibility to turn a pcap file into a CSV with all the information needed as input for the estimation algorithms which is the number of bytes for each equally spaced time interval (minimum in milliseconds), it does have its limitations considering the available number of lines in a CSV file so an alternative was instead used. 3.4.3Editcap Editcap is a program that reads some or all of the captured packets from the infile, optionally converts them in various ways and writes the resulting packets to the capture outfile (or outfiles). By default, it reads all packets from the infile and writes them to the outfile in pcapng file format. An optional list of packet numbers can be specified on the command tail; individual packet numbers separated by whitespace and/or ranges of packet numbers can be specified as start-end, referring to all packets from start to end. By default the selected packets with those numbers will not be written to the capture file. If the -r flag is specified, the whole packet selection is reversed; in that case only the selected packets will be written to the capture file. Here are some of Editcap’s functionalities: • It can be used to remove duplicate packets. Several different options (-d, -D and -w) are used to control the packet window or relative time window to be used for duplicate comparison. • Assigning comment strings to frame numbers. 3.4. Data Set Filtering 28 • Able to detect, read and write the same capture files that are supported by Wireshark. The input file doesn’t need a specific filename extension; the file format and an optional gzip compression will be automatically detected. • Can write the file in several output formats. The -F flag can be used to specify the format in which to write the capture file; editcap -F provides a list of the available output formats. Analysing a large pcap file cannot be done through Wireshark as the program crashes before loading the file completely. Because of this it is required to split the files that form the data set into smaller ones using Editcap. This was done through the flag -i. -i <seconds per file> Splits the packet output to different files based on uniform time intervals using a maximum interval of <seconds per file> each. Floating point values (e.g. 0.5) are allowed. This following Python code snippet demonstrates how Editcap was also used to split a pcap file into multiple files, as the tool Tshark (3.4.4) has a file size limit in order to work properly. def edit(): startdir=’.’ for root, dirs, files in os.walk(startdir): for file in files: if file.endswith(’.pcap’): filename=os.path.join(root,file) cmd = ’editcap -i 30 "{}" "{}"’.format(filename,filename) os.system(cmd) cmd2 = ’mv {} ..’.format(filename) os.system(cmd2) return filename Each output file will be created with an infix _nnnnn[_YYYYmmddHHMMSS] inserted before the file extension (which may be null) of outfile. The infix consists of the ordinal number of the output file, starting with 00000, followed by the timestamp of its first packet. The timestamp is omitted if the input file does not contain timestamp information. After packets for the specified time interval are written to the output file, the next output file is opened. The default is to use a single output file. This option conflicts with -c. The following commands correspond to the necessary formatting of the pcap files so they can be processed by the sampling framework previously described. The first one was used for the full data set of OC48 and OC192. For the OC48 data set and as the files being older, the formatting used by looking at the -F flag was through libpcap. 3.7. Selfis 35 where λ is a frequency, N is the number of terms in the series, and Xj is the data. Because I(λ) is an estimator of the spectral density, a series with long-range dependence should have a periodogram which is proportional to |λ|1−2H close to the origin. Therefore, a regression of the logarithm of the periodogram on the logarithm of the frequency λ should give a coefficient of 1 −2H. The slope provides an estimate of H. Figure 20: OC192 SELFIS Hurst estimation - Periodogram 3.7 selfis The testing and results were obtained using the self-similarity analysis software tool SELFIS[ 33 ], capable of applying all of the Hurst estimation algorithms referred in 3.6 to an input file which contains values of a time series, It can also obtain basic statistics, the graphical display of the power spectrum function and the autocorrelation function (ACF). Figure 21: Example of SELFIS software tool GUI 3.7. Selfis 36 Due to limitations in the amount of data the SELFIS software tool could import, the comparisons between the different time granularities might not be completely accurate but a close approximation, as each data set could only be partially loaded. Note that comparisons between original and sampled data sets should be accurate as they contain the same amount of values, with the exception of some sampling techniques which shortened the sampled time series data set. The SELFIS software tool also returns the correlation coefficient in a percentage value for the Aggregate Variance. Some other estimators are also available such as the Absolute Moment, Whittle estimator, Variance of Residuals and Abry-Veitch estimator, which were not used for testing. 4 TEST AND RESULT ANALYSIS The following sections are the results obtained using the SELFIS software tool for the Hurst parameter estimations with the Aggregate Variance, R/S and Periodogram algorithms as well as the basic statistics for containing the mean throughput in the natural logarithm of the number of bytes and the conversion to Mbps. For the R/S algorithm, Matlab was used as SELFIS presented unexpected and inconsistent results. The time frames chosen to represent the OC48 and OC192 and the respective sampled data sets were the 0.1s, 0.01s and 0.001s. 4.1 oc-48 With a 0.1s time frame only N=65536 samples could be imported to the SELFIS tool (out of 108000), for 0.01s N=1048576 (out of 1080000) and finally for the 0,001s time frame N=8388608 (out of 10800000) for the original data sets. Note that the OC48 data set should be 10800s long which corresponds to three hours of network traffic data. Each of the sampled data sets have a different number of samples depending on the sampling technique used. 4.1.1Basic Statistics As it has been previously referred in 2.1.3, the accuracy in estimating traffic behavior is analyzed through instantaneous throughput, which is the throughput estimated in each sample along the measurement process, as well as mean throughput which is the total estimated load. The accuracy in instantaneous throughput estimation is measured using the variance, where a smaller variance means a more accurate estimation. The boxplots were obtained with Matlab[34] using the following code as example. Input = {OC48_0_1LOGBytes, OC48_0_1LOGBytesLP, OC48_0_1LOGBytesMuST, OC48_0_1LOGBytesRANDC, OC48_0_1LOGBytesSYSTC1_8, OC48_0_1LOGBytesSYSTC1_100, OC48_0_1LOGBytesSYSTC1_256, OC48_0_1LOGBytesSYSTT100_500, OC48_0_1LOGBytesSYSTT200_500, 37 4.1. OC-48 38 OC48_0_1LOGBytesSYSTT500_1500, OC48_0_1LOGBytesSYSTT500_3500}; % Pad each vector with NaN values to equate lengths maxNumEl = max(cellfun(@numel,Input)); Cpad = cellfun(@(x){padarray(x(:),[maxNumEl-numel(x),0],NaN,’post’)}, Input); % Convert cell array to matrix and run boxplot Cmat = cell2mat(Cpad); boxplot(Cmat,Dataset); title(’OC48 Boxplot - 0.1s time frame’) xlabel(’Data set’) ylabel(’Number of bytes per sample(in ln)’) 0.1s time frame data set On Table 3are presented statistics such as mean (natural logarithm of the number of bytes at the 0.1s time frame interval and corresponding throughput in Megabits per second (e15.30)∗8=353Mbps), variance, standard deviation and skewness. The sampling techniques data set that more closely resembles the original data set in terms of resulting statistics are MuST and the count-based techniques. The SystT sampling technique presented poor results with relatively close mean average to the original but with high variance and deviation as shown in the boxplot represented in Fig. 22. Also as expected in the case of the count-based techniques, if you multiply the interval of the sampling frequency the with the estimated throughput, that number comes close to the original data set calculated throughput, so for example SystC(1/8) : 39 ∗8=312Mbps , for SystC(1/100) : 3.5 ∗100 =350, and so forth. Table 3: OC48 Basic statistics - 0.1s interval per sample Mean Throughput Variance Std.Deviation Skewness Original 15.30 353Mbps 0.006 0.079 -4.554 LP(100/200)14.15 112Mbps 1.747 1.321 -1.649 MuST(200/500)15.15 304Mbps 0.620 0.787 -4.699 RandC(1/100)10.69 3.5(350)Mbps 0.021 0.145 -1.059 SystC(1/8)13.10 39(312)Mbps 0.007 0.086 -3.569 SystC(1/100)10.68 3.5(350)Mbps 0.021 0.146 -1.046 SystC(1/256)9.737 1.4(358)Mbps 0.048 0.219 -0.840 SystT(100/500)10.62 3.3Mbps 23.46 4.844 -0.158 SystT(200/500)12.17 15.4Mbps 20.72 4.551 -0.832 SystT(500/1500)13.78 77.2Mbps 12.44 3.527 -1.967 SystT(500/3500)13.81 79.6Mbps 12.05 3.471 -1.985 4.1. OC-48 39 Looking at Fig. 22, it is easy to come to the conclusion that the time-based techniques show very high variances except for MuST. The variance of the count-based techniques is very close to that of the original data set, but with a lower amount of bytes per sample, because of the packet selection through the sampling process (for the SystC(1/8) only 1 packet will be selected out of 8making the throughput estimations lower). Figure 22: OC48 Original and sampled data sets Boxplot - 0.1s time frame 0.01s time frame data set Looking at the following Table 4of the OC48 data sets obtained basic statistics for the 0.01s time frame. At finer granularities the time-based techniques start performing better in terms of estimating the mean throughput when compared to 3. Still, SystC(1/8) and MuST are the best two sampling techniques if you want to accurately estimate throughput, as the variance observed in these data sets is very comparable to the original data set. Looking at Fig. 23, the time-based techniques start performing better, contrary to the count-based techniques. However the SystT sampling technique still presents very high variance. 4.1. OC-48 40 Table 4: OC48 Basic statistics - 0.01s interval per sample Mean Throughput Variance Std.Deviation Skewness Original 13.02 361Mbps 0.014 0.119 -0.968 LP(100/200)12.83 299Mbps 0.356 0.597 -6.237 MuST(200/500)12.99 350Mbps 0.030 0.175 -6.359 RandC(1/100)8.327 3.3(330)Mbps 0.236 0.486 -1.327 SystC(1/8)10.82 40(320)Mbps 0.026 0.162 -0.639 SystC(1/100)8.319 3.3(330)Mbps 0.233 0.483 -1.317 SystC(1/256)7.164 1.0(256)Mbps 0.909 0.953 -1.152 SystT(100/500)12.36 187Mbps 4.384 2.094 -3.107 SystT(200/500)12.68 257Mbps 2.452 1.566 -4.538 SystT(500/1500)12.89 317Mbps 1.005 1.002 -7.394 SystT(500/3500)12.89 317Mbps 0.959 0.979 -7.438 Figure 23: OC48 Original and sampled data sets Boxplot - 0.01s time frame 0.001s time frame data set Once again, looking at Table 5presenting the resulting OC48 basic statistics for the 0.001s time frame, and comparing the original data set to the sampled ones, the time-based sampling techniques (LP, MuST and SystT) even though showing a more skewed data series, start performing better than the count-based ones for calculating throughput. Count-based techniques show increasingly worse results with the finer the time granularity data sets, but SystC(1/8) still presented good results. 4.1. OC-48 41 The statistics obtained from the SystT technique data set are also a lot closer relative to the original data set in terms of mean when compared to the 0.1s and 0.01s time frames, however still presenting strong skewness. Table 5: OC48 Basic statistics - 0.001s interval per sample Mean Throughput Variance Std.Deviation Skewness Original 10.69 351Mbps 0.066 0.258 -0.510 LP(100/200)10.65 338Mbps 0.149 0.386 -7.572 MuST(200/500)10.67 344Mbps 0.066 0.257 -1.267 RandC(1/100)5.592 2.1(210)Mbps 2.274 1.508 -0.011 SystC(1/8)8.420 36(288)Mbps 0.261 0.511 -1.282 SystC(1/100)5.464 1.9(190)Mbps 2.245 1.498 0.093 SystC(1/256)5.448 1,9(486)Mbps 2.234 1.494 -0.118 SystT(100/500)10.63 331Mbps 0.307 0.554 -8.122 SystT(200/500)10.65 338Mbps 0.193 0.440 -8.539 SystT(500/1500)10.68 348Mbps 0.116 0.340 -7.355 SystT(500/3500)10.68 348Mbps 0.113 0.337 -7.122 Looking at Fig. 24, the results are further amplified from the previous time frame plotted by Fig. 5. At this time frame, the time-based techniques are the best performers, with the count-based sampling techniques becoming less accurate than in the previous time frames. Figure 24: OC48 Original and sampled data sets Boxplot - 0.001s time frame 4.1. OC-48 42 4.1.2Aggregate Variance Looking at Table 6containing the Aggregate Variance algorithm Hurst parameter estimations, the results show a very strong long range dependence on both the original and the sampled data sets except for the Systematic Time-based technique (SystT) at coarser granularity time frames (0.1s) in which the resulting parameter implies the sampled data series is closer to a random walk. The count-based sampling techniques are the best performers at the 0.1s and 0.01s time frames. At THE finer time frame of 0.001s all the data sets of different sampling techniques show estimations close to the original data set, with some of the best performing techniques being MuST, SystC(1/8) and the SystT techniques. Note that the correlation coefficient is very high, on all time frames and data sets. Table 6: OC48 Aggregate Variance - Hurst parameter estimation and Correlation Coefficient 0.1s0.01s0.001s Original 0.857(86.88%) 0.923(96.38%) 0.908(93.15%) LP(100/200)0.649(99.01%) 0.671(94.96%) 0.771(94.23%) MuST(200/500)0.635(96.38%) 0.833(95.55%) 0.836(92.73%) RandC(1/100)0.814(94.38%) 0.837(94.50%) 0.740(93.92%) SystC(1/8)0.851(88.41%) 0.907(96.01%) 0.876(91.89%) SystC(1/100)0.815(94.50%) 0.835(94.58%) 0.727(94.96%) SystC(1/256)0.769(95.60%) 0.798(94.89%) 0.741(94.78%) SystT(100/500)0.429(96.86%) 0.611(97.51%) 0.776(91.35%) SystT(200/500)0.431(96.29%) 0.691(94.70%) 0.830(96.10%) SystT(500/1500)0.499(98.81%) 0.721(95.00%) 0.874(93.90&) SystT(500/3500)0.512(98.41%) 0.701(95.69%) 0.865(94.66%) 4.1. OC-48 43 Figure 25: Bar chart of OC48 Aggregate Variance Hurst estimation per time frames 4.1.3R/S Looking at the results presented in Table 7the R/S algorithm indicates LRD on all of the original data sets, showing stronger long range dependence at the coarser granularity of the 0.1s time frame. The sampling techniques show varying results with for example LP performing well at the 0.1s time frame and 0.001s. The SystC(1/8) data set shows very close results to the original one at all time frames and therefore being the best performing technique and interval, The time-based techniques start performing better at the 0.001s time frame. 4.1. OC-48 44 Table 7: OC48 R/S - Hurst parameter estimation 0.1s0.01s0.001s Original 0.793 0.658 0.621 LP(100/200)0.747 0.409 0.585 MuST(200/500)0.281 0.614 0.626 RandC(1/100)0.613 0.564 0.542 SystC(1/8)0.741 0.614 0.575 SystC(1/100)0.617 0.565 0.542 SystC(1/256)0.590 0.555 0.550 SystT(100/500)0.473 0.412 0.514 SystT(200/500)0.456 0.368 0.558 SystT(500/1500)0.426 0.426 0.598 SystT(500/3500)0.440 0.460 0.608 Figure 26: Bar chart of OC48 Rescaled Range Hurst estimation per time frames 4.1.4Periodogram According to the author of [ 19 ] the Periodogram algorithms can present some values over 1 because in some cases non-stationarities are so complex, that conventional models fail to accommodate them, which can result in estimates of the Hurst parameter greater than or equal to 1, as shown in the following Table 8with the original data set at the 0.1s time frame. 4.2. OC-192 51 Table 13: OC192 R/S - Hurst parameter estimation 0.1s0.01s0.001s Original 0.800 0.740 0.732 LP(100/200)0.598 0.474 0.658 MuST(200/500)0.445 0.650 0.774 RandC(1/100)0.793 0.703 0.650 SystC(1/8)0.798 0.734 0.724 SystC(1/100)0.790 0.703 0.650 SystC(1/256)0.763 0.670 0.602 SystT(100/500)0.586 0.297 0.458 SystT(200/500)0.432 0.315 0.545 SystT(500/1500)0.340 0.452 0.689 SystT(500/3500)0.366 0.492 0.718 Figure 32: Bar chart of OC192 Rescaled Range Hurst estimation per time frames 4.2.4Periodogram Using the Periodogram algorithm on OC192 data set with different time frames, show stronger LRD at 0.1s as it did with the OC48 data set. Best performing sampling techniques are the count-based ones, mainly RandC and SystC(1/8). Time-based techniques start performing closer to the Original data set at the 0.001s time frame. 4.2. OC-192 52 Table 14: OC192 Periodogram - Hurst parameter estimation 0.1s0.01s0.001s Original 0.857 0.676 0.755 LP(100/200)0.650 0.553 0.716 MuST(200/500)0.575 0.662 0.762 RandC(1/100)0.867 0.661 0.649 SystC(1/8)0.859 0.676 0.742 SystC(1/100)0.742 0.658 0.648 SystC(1/256)0.951 0.778 0.838 SystT(100/500)1.035 0.435 0.652 SystT(200/500)0.974 0.497 0.687 SystT(500/1500)0.618 0.516 0.713 SystT(500/3500)0.536 0.508 0.726 Figure 33: Bar chart of OC192 Periodogram Hurst estimation per time frames 4.2.5Autocorrelation Function The Autocorrelation function (ACF) previously described in 2.2.4. According to the developer of the SELFIS software analysis tool [ 33 ], shows the value of the autocorrelation coefficient for different time lags k as previously described in 15. 4.2. OC-192 53 The following Figures 34,35 and 36 show the graphical representation of the ACF of typical long-range dependent processes as the they slowly decay to zero for the Original, Random count-based and Systematic count-based techniques. The ACF for the 0.01s and 0.001s time frames present the same behaviour even though they are not visually represented here. Original data set - 0.1s time frame Figure 34: ACF graph of OC192 Original data set - 0.1s time frame Random count-based data set - 0.1s time frame Figure 35: ACF graph of OC192 RandC data set - 0.1s time frame 4.2. OC-192 54 Systematic count-based data set - 0.1s time frame Figure 36: ACF graph of OC192 SystC data set - 0.1s time frame However for the time-based techniques represented by 37,38 and 39, the behaviour is a lot different to both the count-based techniques and each other, possibly because of the periodicity introduced by the time-based techniques. LP data set - 0.1s time frame Figure 37: ACF graph of OC192 LP data set - 0.1s time frame 4.3. Summary 55 MuST data set - 0.1s time frame Figure 38: ACF graph of OC192 MuST data set - 0.1s time frame Systematic time based data set - 0.1s time frame Figure 39: ACF graph of OC192 SystT data set - 0.1s time frame 4.3 summary According to the author of [ 15 ] the presence of periodicity in a time series may have an influence on the estimation of the long memory (long-range dependence) parameter H, as some estimators falsely detect the presence of long-range dependence when periodicity is present. Both the OC48 and OC192 present similar results with all the different sampling techniques tested, both in regards of basic statistics and Hurst estimation parameter. 4.3. Summary 56 4.3.1Data Volume Note that even though the OC192 capture was one hour long, it still used a lot more disk space volume in comparison to the OC48 capture which was three hours long, as the data transfer rates and bandwidth of OC192 are a lot higher. The next Fig. 40 demonstrates how much space each data set occupies, including the sampled ones. Figure 40: Original and sampled OC data sets volume 4.3.2Throughput and Hurst Estimations In terms of estimating throughput and the Hurst parameter, with all three algorithms and three different time frames tested from both OC48 and OC192, the best performing techniques are very dependent on the time frame of the data set. As expected for the Hurst estimations, the original series showed LRD or strong memory. however only some sampled data sets still maintained that property of Internet traffic. For the 0.1s time frame, the best performing techniques were the count-based ones (RandC and SystC), which like the original data set, present very low variance and deviation, necessary for instantaneous throughput estimations to be accurate. 4.3. Summary 57 However, as the time granularity becomes smaller (0.01s and 0.001s time frames), the count-based techniques start performing worse, inversely to what happens with the timebased techniques. These start to shine in particular with the MuST which was the most consistent technique, presenting good results, even at the 0.1s time frame. The sampling technique of SystC with the sampling interval of (1/8) was also a very consistent data set in both throughput and Hurst estimations, even at the finer granularity time frames, which is impressive considering it is one of the sampling techniques that use the least amount of data volume, compared to the time-based techniques. 5 CONCLUSION The work developed in this dissertation was mainly focused on the statistical properties of sampled Internet traffic when compared to to the original data and in which way those properties are affected due to the loss of data after applying the sampling process with the advantage of lower computational resources being needed. Depending on which type of sampling processes used and whether they are count-based or time-based as well as the time frame of the data set is used, the results obtained with the estimation algorithms are different. The resulting sampled data sets also use a different amount of disk space, with time-based techniques generally using more when compared to the count-based techniques. Analysing the tests and results obtained described in Chapter 4, it is still possible to gather accurate information for network traffic analysis after applying the sampling process to the original traffic data, both in terms of estimating throughput, as well as in determining if the sampled series still maintain the property of long range dependence (LRD). SystC(1/8) and MuST had some of the consistent results both in throughput and Hurst parameter estimations, presenting very low variance in the number of bytes per sample of the time frame selected. Therefore these data sets provide good estimations on instantaneous and mean throughput and on the Hurst parameter. Time-based techniques (LP, MuST and SystT) also start performing better at the finer granularity time frames, inversely to what happens to count-based techniques, mainly at less frequent sampling intervals as, for example, SystC(1/100) or SystC(1/256). 5.1 future work Additional work associated can still be developed to better understand how the sampling process affects the results of the Hurst parameter and other statistics. For example, it is possible to apply a smoothing function on the original and sampled data sets or a low-pass filter which is a filter that passes signals with a frequency lower than a selected cutoff frequency and attenuates signals with frequencies higher than the cutoff frequency to 58 5.1. Future Work 59 eliminate certain periodicities of the original and sampled signals, as well as using different data sets and algorithm combinations. It is also possible to obtain some other statistics and the usage of different intervals for each of the sampling techniques than the ones tested in this dissertation to evaluate how much that parameter affects the results. BIBLIOGRAPHY [1] João Marco C. Silva, Paulo Carvalho, and Solange Rito Lima. Computational weight of network traffic sampling techniques. In 2014 IEEE Symposium on Computers and Communications (ISCC), pages 1–6,2014. doi: 10.1109/ISCC.2014.6912467. [2] S. Bregni. Compared accuracy evaluation of estimators of traffic long-range dependence. In 2014 IEEE Latin-America Conference on Communications (LATINCOM), pages 1–5,2014. doi: 10.1109/LATINCOM.2014.7041868. [3] T. Karagiannis, M. Molle, and M. Faloutsos. Long-range dependence ten years of internet traffic modeling. IEEE Internet Computing,8(5):57–64,2004. doi: 10.1109/MIC.2004.46. [4] H. E. HURST. Long-term storage capacity of reservoirs. Trans. Amer. Soc. Civil Eng.,116: 770–799,1951. URL https://ci.nii.ac.jp/naid/10024052023/en/. [5] AJ Lawrance and NT Kottegoda. Stochastic modelling of riverflow time series. Journal of the Royal Statistical Society: Series A (General),140(1):1–31,1977. [6] John Haslett and Adrian E. Raftery. Space-time modelling with long-memory dependence: Assessing ireland’s wind power resource. Journal of the Royal Statistical Society. Series C (Applied Statistics),38(1):1–50,1989. ISSN 00359254,14679876. URL http://www.jstor. org/stable/2347679. [7] A Montanari, R Rosso, and MS Taqqu. A seasonal fractional differenced arima model: An application to the river nile monthly flows at aswan. preprint,1995. [8] Alberto Montanari, Renzo Rosso, and Murad S Taqqu. Some long-run properties of rainfall records in italy. Journal of Geophysical Research: Atmospheres,101(D23):29431–29438,1996. [9] Alberto Montanari, Renzo Rosso, and Murad S Taqqu. Fractionally differenced arima models applied to hydrologic time series: Identification, estimation, and simulation. Water resources research,33(5):1035–1044,1997. [10] Clive William John Granger and Paul Newbold. Forecasting economic time series. Academic Press, 2014. [11] Richard T Baillie. Long memory processes and fractional integration in econometrics. Journal of econometrics,73(1):5–59,1996. 60