Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool

optimization of and master into six sections: New Generation Networks, Quality of Services, Sensor Networks, Telecommunications, Traffic Engineering and Routing.

During past years another aspect of network traffic studying has also appeared. In this case, the network traffic is researched from application or data source point of view, especially focused on statistics of file sizes and inter-arrival times between files [19]. These research works are very important for describing a relation between packet network traffic on lower ISO/OSI layers and data source network traffic on higher layers of ISO/OSI model. Based on the research of WWW network traffic, it has been shown that file sizes of such traffic are best described by Pareto distribution with shape parameter = 1 [38]. That was also shown for the FTP traffic, where the shape parameter of Pareto distribution is in the range 0.9 < < 1.1 [20]. In [6], [39], and [40] it is shown that inter-arrival time of TCP connections are selfsimilar processes, which can be described by Weibull heavily tailed distribution.
With expansion of simulation tools, which are used for simulation of communication networks, the knowledge about simulating the network traffic also becomes very important. One of the important tasks in simulations is also knowledge about modeling and simulating of network traffic. Network traffic is usually modeled in simulation tools from an application point of view [42], [45]. It is usually supposed that the file size statistics and file inter-arrival times are known [39], [40]. Such kinds of traffic models are supported by most commercial telecommunication simulation tools such as the OPNET Modeler [10], [11], [24], used in our simulations and experiments. Consequently, for using the measured data of packet traffic, when modeling file statistics, it is necessary to transform packets' statistics into files' statistics [9,10]. This transformation contains opposite operations in relation to the fragmentation and encapsulation process. Extensive research and investigation about traffic sources in contemporary networks show that this approach requires an in-depth analysis of packet's traffic (which needs specialized, very powerful and consequently, expensive instruments). This approach, in the case of encrypted packets and non-standard application protocols, is not completely possible. In such cases, capture of entire packets is also necessary, which can be problematic in contemporary high-speed networks. Another approach estimates distribution parameters of file data sources from measured packets' network traffic. For such approach, we have developed and tested different methods [42], [45]. Estimated distribution parameters are used for modeling of the measured network traffic for simulation purposes. Through the use of these methods we want to minimize discrepancies between the measured and simulated traffic in regards to an average bit rate and bursts, which are characteristic of self-similar traffic.

Network traffic 2.1 Packet network traffic measuring
The measuring and analyzing of real network traffic provide us with a very important knowledge about computer network states. In analyzing process, we need statistical mathematical tools. These tools are crucial for accuracy of a derived mathematical model, described by stochastic parameters for packet size and inter-arrival time [9]. Using this simulation model, we want to acquire information about telecommunication network's performances for: • improvement of the current network, • bottleneck searching, • building and development of new network devices and protocols, www.intechopen.com • and for ensuring quality of service (QoS) for real-time streaming multimedia applications.
Using this information, network administrators can make the network more efficient.
The simplest tools that measure and capture the packets of network traffic are packet sniffers. Packet sniffers, also known as protocol or network analyzers, are tools that monitor and capture network traffic with all content of network traffic. We can use sniffers to obtain the main information about network traffic, such as packet size, inter-arrival time and the type and structure of IP protocol. Sniffers have become very important and indispensable tools for network administrators. Figure 1 shows traffic captured by a packet sniffer. Any sniffers are able to extract this data from the IP headers. Knowing them, it is then simple to calculate a length of IP PDU (Protocol Data Unit), which also contains a header of higher layer protocols. Using an in-depth header analysis, it is possible, in the similar way to the IP header, to calculate the lengths of all these headers.
An analytical description of network traffic does not exist, because we cannot predict the size and arrival time of the next packet. Therefore, we can only describe network traffic as a stochastic process. Hence, we have tried to describe these two stochastic processes (arrival time and packet size) with the use of Hurst parameter and probability distributions.

Self-similarity
In the 1990s, new descriptions and models of network's traffic were developed, which then replaced the traditional traffic models, such as Poisson and Markov [5], [20]. The Poisson process was widely used in the past, because it gave a good approximation of telephone network (PSNT networks), especially when describing times between each call and call durations. This model is usually described by exponential probability distribution, which is characterized by the parameter λ (number of events per second  [4]. This contrasts the traditional traffic model (Poisson model), which becomes very smooth during the aggregation process.

Self-similarity
The definition of self-similarity is usually based on fractals for the standard stationary time series [5], [6], [21].
Let X = (X t , t = 0, 1, 2,…) be a covariance stationary stochastic process; that is a process with a constant mean, finite variance , that depends only on k. Then the autocorrelation function r(k) is: Assume X has an autocorrelation function, which is asymptotically equal to: where L 1 (k) slowly varies at infinity, that is 11 1 lim( ( ) / ( )) t Lt x Lt →∞ = for all x > 0. Such functions are for example L 1 (t) = const. and L 1 (t) = log(t)) [5], [6].

www.intechopen.com
The measure of self-similarity is the Hurst parameter (H), which is in a relationship with the parameter in equation (3).
Let's define the aggregation process for the time series [5], [6]: For each m = 1, 2, 3, … let X (m) = (X k (m) , k = 1,2,..m) denote a new time series obtained by averaging the original series X over a non-overlapping block of size m. That is, for m=1, 2, 3, …, X (m) is given by:  X k (m) is the process with average mean and autocorrelation function r (m) (k) [6].
The process X is called an exactly second order with parameter H, which represents the measure of self-similarity if the corresponding aggregated X (m) has the same correlation structures as X and The process X is called an asymptotically second order with parameter H = 1 -/2, if for all k it is large enough, It follows from definitions that the process is the second order self-similar in the exact or asymptotical sense, if their corresponding aggregated process X (m) is the same as X or becomes indistinguishable from X-at least with respect to their autocorrelation function. The most striking property in both cases, exact and asymptotical self-similar processes, is that their aggregated processes X (m) possess a no degenerate correlation structure as m → ∞. This contrasts with the Poisson stochastic models, where their aggregated processes tend to second order pure noise as m → ∞: Network traffic with bursts is self-similar, if it shows bursts over many time scales, or it can be also said over a wide-range of time scales. This contrasts with traditional models such as Poisson and Markov, where their aggregation processes become very smooth.

Long-range dependence
The self-similar process can also contain a property of long-range dependence [5]- [8]. Long range dependence describes the memory effect, where a current value strongly depends upon the past values, of a stochastic process, and it is characterized by its autocorrelation function. This property has a stochastic process, which satisfies relation (2), order with relation r(k) = (k)/σ 2 .
For values 0.5 < H < 1 autocorrelation function r(k) behavior, in an asymptotic mean, as ckfor values 0 < < 1, where c is constant c > 0, = 2 -2H, and we have: The autocorrelation function decays hyperbolically, as the k increases, which means that autocorrelation function is non-summable. This is opposite to the property of short-range dependence (SRD), where the autocorrelation function decays exponentially and the equation (9) has a finite value. Short and long-range dependence have a common relationship with the value of the Hurst parameter of the self-similar process [6], [21]: Comparison between autocorrelation function of short range dependence process (left) and autocorrelation function of long range dependence process (right) [15]. www.intechopen.com

Heavy-tailed distributions
Self-similar processes can be described by heavy-tailed distributions [5], [6], [9]. The main property of heavy-tailed distributions is that they decay hyperbolically, which is opposite to the light-tailed distribution, which decays exponentially. The simplest heavy-tailed distribution is Pareto. The probability density function of Pareto distribution is given by where parameter represents the shape parameter, and k represents the local parameter of distribution (also a minimum possible positive value of the random variable x).

www.intechopen.com
Another very important heavy-tailed distribution is Weibull distribution, which is described by [44]: (11) where parameter presents the shape parameter, and k presents the local parameter of distribution. www.intechopen.com

Network traffic definitions
The network traffic can be observed on different layers of ISO/OSI model, for that reason we define different kinds of network traffics. The network traffic can be represented as a stochastic process, which can be interpreted as the traffic volume -measured in packets, bytes or bits per time unit, and it is consequent on data or packets, which are sent through the network in time unit. If we observe network traffic on the low level of ISO/OSI model, then define the packet network traffic [45] The measured network traffic is packet network traffic, which can be captured using special software program or hardware devices. For that reason, the measured network traffic is marked as Z pm [n]. We also define modeled (simulated) network traffic as Z ps [ Transformation (19) and (20) allows estimation of packet traffic processes from data source traffic processes or vice verse.

Hurst parameter estimations
Hurst's parameter represents the measure of self-similarity. There are several methods for estimating Hurst's parameter (H) [1]- [4] of stochastic self-similar processes. However, there are no criteria as to which method gives the best results. There are several different methods for estimating the Hurst parameter which can lead to diverse results [9], [10]. This is the reason why Hurst's parameter cannot be calculating but can be estimated. The most often used methods for Hurst's parameter estimation are [6], [8], [21]: • Variance method is a graphical method, which is based on the property of slowly decaying variance. In a log-log scale plot, a sample variance versus a non-overlapping block of size m is drawn for each aggregation level. From the line with slope we can estimate Hurst's parameter as a relationship, from equation (3). • R/S method is also a graphical method. It is based on a range of partial sums regarding data series deviations from mean value, rescaled by its standard deviation. The slope in the log-log plot of the R/S statistic versus aggregated points is the estimation for Hurst's parameter.

•
Periodogram method plots spectral density in a logarithm scale versus frequency (also in logarithm scale). The slope in periodogram allows the estimation of parameter H.

Distribution parameter estimation for stochastic process of network traffic
Network traffic can be described by two stochastic processes, one for packet/data sizes and one for packet/data inter-arrival time. All processes are usually described by probability distributions. Self-similar process can be described by heavy tailed distributions. The main task for modeling the stochastic process with probability distribution is to choose the right distribution, which would be a good representation of our network traffic stochastic process. The statistic distribution parameters of data sources are then estimated by fitting tools [9], [25], [26] or other known methods, such as CCDF [6] or Hill estimator [17], [18]. Mathematical fitting tools are used (EasyFit), which allow us to automatically include the fit distribution of the stochastic process, and also estimate parameters of distribution from the captured traffic [9], [29].

Simulation of network traffic in simulation tools
One of the very important tasks in simulation is modeling the real network parameters and network elements for simulation purposes. The main goal in successful modeling of network traffic is to minimize discrepancies between the measured simulations and by simulations statistically-modeled and generated traffic. This means, that both traffics are similar within the different criteria, such as bit and packet-rate, bursts (Hurst's parameter), variance, etc.
Network traffic simulations are usually based on modeling of data sources or applications. One of the most known simulation tools is OPNET Modeler [22], [23]. A simulation of network traffic in this tool is based on the "on/off" models [41] or more often used traffic generators. Difference between these manners is in a modeling manner. In the first case, the arrival process is described by Hurst's parameter (H) and the data length process is described by probability density function (pdf). In the second case, processes of data length and data inter-arrival time are both described by pdf.
In OPNET Modeler, two standard node models appear [9]: Raw Packet Generator (RPG) is a traffic source model [16], [27] implemented specially to generate self-similar traffic, which is based on different fractal point processes (FPP) [41]. Self similar traffic is modeled with an arrival process, which is described by Hurst's parameter and the distribution probability for packet sizes. This arrival process can be based on many different parameters, such as Hurst parameter, average arrival rate, fractal onset time scale, source activity ratio and peak to mean ratio [16]. There are several different fractal point processes (FPP). In our case, we used the superposition of the fractal renewal process (Sub-FRP) model, which is defined as the superposition of M independent and probably identical renewal fractal processes. Each FRP stream is a point renewal processes and M numbers of independent sources compose the Sub-FRP model. Common inter-arrival probability density function p(t) of this process is: where 1 < < 2. Process FRP can be defined as Sup-FRP process, when the number of independent identical renewal processes (M) is equal to 1. A model Sub-FRP is described by three parameters: , A and M. represents the fractal exponent, A is the location parameter, and M is the number of sources. These three parameters are in relationship with three OPNET parameters. These parameters are Hurst's average arrival-rate λ, and fractal onset time-scale (FOTS). The relationships between these three parameters of Sub-FRP and parameters in OPNET model are: The IP station [16] can contain an arbitrary number of independent simultaneous workingtraffic generators. Each generator enables the use of heavy-tailed distributions, such as Pareto or Weibull, for the generation of a self-similar network traffic by two distributions, one for length of a data source process and another for data inter-arrival time process. In our research, a traffic generator contained in an Ethernet IP station model of the OPNET Modeler simulation tool is used, as shown in the Figure 8. In the IP station model, the traffic generator is placed above the IP encapsulation layer, which takes care of packets' formations and fragmentation. This is the process of segmentation of long data into the shorter packets, or vice versa, according to the RFC 793 [12]. Padding of the packet data payload with additional bits is also performed when data is shorter than a predefined minimal payload. Because the traffic is modeled, above IP level of the TCP/IP model, to the lengths of the generated data, 20 bytes of IP header are added. 18 bytes of information for MAC (14bytes) and CRC (4 bytes) are also further added. Structure of Ethernet frame used in the IP station model. Using this model, the applications' protocol does not impact the generated traffic. The model is suitable for the simulation cases, when we want to statistically model the network traffic, which can be caused by many arbitrary communications' applications. Using this approach, we can model such network traffic by single traffic source.

Estimation of simulation parameters of measured network traffic
The main problem of measured packet network traffic modeling is to estimate the parameter, which is needed for modeling measured network traffic in simulation tools. It has already been mentioned that the parameters of data source traffic processes are needed. We already described that transformation from packet network traffic Z p [n] to data source network traffic Z d [n] is needed (section 2.6) [45]. There are many possibilities to make a transformation from Z p [n] to Z d [n], which allows estimation of parameters of data source network traffic processes. We investigated two algorithms [28]: 1. algorithm with an in-depth analysis of all packet headers, 2. algorithm with a coarse inspection of IP header only.
The main differences between them are complexity and the needed execution time. The first algorithm mimics a complete decapsulation process, and defragmentation in higher layers of the communication model. Any sniffers are able to extract this data from the IP header. Knowing them, it is then simple to calculate a length of IP PDU (Protocol Data Unit) which also contains a header of higher layer protocols. Through the use of an in-depth header analysis, it is possible, in the similar way as the IP header, to calculate the lengths of all these headers. Each packed IP header has four the so-called fragmentation fields that contain information about data fragmentation, which is shown on Figure 9. Extensive research and investigation about traffic sources in contemporary networks show that this approach requires an in-depth analysis of packets (where need specialized, very powerful and consequently, expensive instruments), which in case of encrypted packets and non-standard application protocols, is not completely possible. In such cases, it is also necessary to capture the entire packets, which can be problematic in the high-speed networks. For these reasons, a simple algorithm has been developed, where only information of packets sizes, packet time stamps and IP addresses are needed.
The second algorithm skips decapsulation by considering the average lengths of packet headers and then uses only packet lengths and inter-arrival times. In the second case, the algorithm offers the estimation of data source network traffic, not the exact reconstructed data source traffic. The second algorithm represents the main part of method by mimic defragmentation process, which is described in detail in [45]. The main idea of mimic defragmentation process method is to compose data from the captured packet traffic, which is previously fragmented at the transmitter. The data source traffic estimation is carried out by finding and summing fragmented packets' sequences without an in-depth analysis of packets. Fragmented sequence is defined as a sequence of l MTU sized packets associated with the same source and destination addresses and terminated by packet shorter than l MTU .

Simulation results
In real networks, we have captured packets of different network traffic through a Wireshark sniffer. The two different types of measured traffic are used for analysis, modeling and simulation purposes. These two test traffics are shown in Figure 10.  For each of test traffics, the Hurst parameter has been estimated through different methods. The Hurst parameters for both cases are bigger than 0.5, so we can classify these test traffics as a self-similar network traffic. Table 1 contains the estimated parameters H for both traffics, which are estimated by variance, R/S and periodogram methods. We also conducted tests about short and long-range dependence. In the case of the first test traffic, the autocorrelation function decayed hyperbolically, which means, that this traffic can have the property of a long-range dependence. For the second test traffic autocorrelation, function decayed exponentially towards 0. For this case, the sum of autocorrelations has finite results and, therefore, the test traffic 2 has the property of short-range dependence.
For both test traffics (test traffic 1 and test traffic 2) we estimate distribution and its parameters for data source traffic processes for simulation purpose. For that reason, we made an estimation of data source traffic from the captured packet traffic through the mimic defragmentation process method [45]. For both test traffics, the suitably heavy (Pareto or Weibull) and also light-tailed (exponential) distributions are chosen.
Based on the estimated distribution parameters for both measured test traffic (test traffic 1 and test traffic 2), we generated self-similar traffic in the OPNET simulation tool with two different station types -RPG and IP stations. We have created six different scenarios for each of test traffic. In the first two scenarios, the network traffic is generated by an RPG station, where a self-similarity is described by Hurst parameter. During the first scenario, we use heavy-tailed distribution for the data size process, while in the second a light-tailed distribution (exponential) is used. In the next four scenarios, network traffic is generated using the IP station, where we use different combination's distributions for the data size process and data inter-arrival time. One of the criterions, for successful modeling, is the difference between bit and packet-rates of the test traffic and modeled traffic in OPNET simulation tool. Besides the average values of bit and packet-rates, the more important criteria are also bursts' intensity within the network traffic. For each of test traffics (test traffic 1 and test traffic 2), the traffic which best represents the measured test traffic is chosen from six modeled traffics.
Test traffic 1 poses the property of long-range dependence, so there are a lot of bursts in the traffic. We model this measured-test traffic over six different scenarios. The results are shown in Figure 6 and Table 2. Table 2 shows the main properties of measured test traffic 1 and estimated distribution parameters which were used in OPNET simulation tool for simulating network traffic (the left side of Table 2). Table 2 (the right side) also shows main properties of simulated network traffics (six different scenarios) in OPNET simulation tool based on estimated distributions. Table 2 shows modeling results for test traffic 1 over six different scenarios in OPNET simulation tool. There are estimated statistical parameters such as Hurst parameters and distributions used in models and simulation results using these models. Figure 11 shows all six modeled traffic traffics generated by OPNET, with estimated distributions and parameters from Table 2.
The best approximation for test traffic 1 is modeled traffic 5 from Table 2, which is described by Pareto distribution for data size process and Weibull distribution for data inter-arrival time. Figure 12 shows a comparison between the second test traffic and the modeled traffic 5 for bit rates. From all critera after comparison, we can say that the modeled traffic 5 is a good approximation of measured test traffic 1.   Test traffic 2 is also modeled over six different scenarios, just like in the first case. Table 3 shows the main properties of measured test traffic 2 and estimated distribution parameters which were used in OPNET simulation tool for simulating network traffic (left side of Table  3). Table 3 (right side) also shows main properties of simulated network traffics (six different scenarios) in OPNET simulation tool.
As the best modeled traffic of test traffic 2 from all six cases (Table 3), we choose the case where simulated traffic is described by the exponential distribution for packet sizes and Weibull heavy-tailed distribution for inter-arrival time (modeled traffic 4). The bit-rate of this traffic is 33.27 (p/s) and packet-rate is 126.79 (kb/s), which are very close to the measured values. The Hurst parameter of the simulated traffic is 0.58, which is also close to the estimated values of the measured traffic. Figure 13 shows the comparison between the measured test traffic 2 and the best-modeled traffic (modeled traffic 4) for bit rates. From all critera after comparison, we can say that the simulated traffic is a good approximation of the measured traffic 2.

Conclusion
In this chapter, we present our research in the area of measurements, modeling and simulations of the self-similar network traffic. Firstly, the state of the art method for modeling and simulating of self-similar network traffic is presented. We also describe a number of facts about self-similarity, long range dependences and probability, which are used to describe such stochastic processes. Described as well are the mechanism and models to simulate network traffic in the OPNET Modeler simulation tool. The main goal of our research is to simulate measured network traffic, where we tend to minimize discrepancies between the measured and the simulated network traffic in the sense of packet-rate, bit-rate, bursts intensity, and variances. One of the big challenges in our research work was to find appropriate method to estimate parameters of data source network traffic processes that are based on measured network packet's traffic. The estimated parameters are needed during the modeling of the measured network traffic in the simulation tool. For those reasons, we have developed different methods, which allow estimation of the parameters of data source network traffic processes, based on the measured network packet's traffic.
At the end of the chapter, all phases needed for simulating the measured network traffic in the OPNET simulation tool are presented. During the analysis phase we pay attention to the self-similar property, which has become the basic model for describing today's network traffic. In the network traffic theory, the properties of short and long-range dependence are directly prescribed by the values of estimated parameter H. In our network traffic analysis, we prove that network traffic (test traffic 2) can exist where Hurst parameter is bigger than 0.5, but this process does not have the property of a long-range dependence.
For the purpose of parameters estimation of data source network traffic processes, we have used a method that mimics packet defragmentation. Through the use of this method we offer estimated parameters, used in simulations, where six traffics are simulated by different distributions for each of the measured test traffic. It can be seen from simulations that in the case of modeling self-similar traffic, short-range dependence is more appropriate for choosing exponential distribution to describe a packet-size process. The exponential distribution does not impact the extreme peaks in the modeled traffic. Pareto distribution is unsuitable for this purpose.
Heavy-tailed distributions, especially Pareto, are suitable for modeling a packet-size process of the measured network traffic, which are self-similar and also have the property of a longrange dependence (test traffic 1).
There are discrepancies between the measured and the modeled traffics in the sense of packet-rate, bit-rate, bursts intensity, and variances. With a method which mimics defragmentation, a good approximation of the measured network traffic is obtained. We cannot claim that this is the optimal method for all situations, because there are some limitations, although it shows good results through simulation in OPNET Modeler. We have noticed that estimating the shape-parameter of Pareto is very delicate, because a small deviation in the parameter causes large discrepancies regarding the network traffic's average values, which is one of the important criteria for traffic modeling.