**2.2 Self-similarity**

In the 1990s, new descriptions and models of network's traffic were developed, which then replaced the traditional traffic models, such as Poisson and Markov [5], [20]. The Poisson process was widely used in the past, because it gave a good approximation of telephone network (PSNT networks), especially when describing times between each call and call durations. This model is usually described by exponential probability distribution, which is characterized by the parameter *λ* (number of events per second). However, these models do not allow for descriptions of bursts, which are distinctive in today's network traffic. Such

Fig. 2. Comparison of self-similar network traffic (left) and synthetic traffic created by Poisson model (right) on different time scales (100, 10, 1, 0.1 and 0.01s). Self similar traffic contains bursts on all time scales in contrast to the generated synthetic traffic, based on the Poisson model, which tends to average on longer time [1].

bursts can be described by a self-similarity model, because it shows bursts over a widerange of time scales [1]-[4]. This contrasts the traditional traffic model (Poisson model), which becomes very smooth during the aggregation process.

#### **2.3 Self-similarity**

354 Telecommunications Networks – Current Status and Future Trends

Any sniffers are able to extract this data from the IP headers. Knowing them, it is then simple to calculate a length of IP PDU (Protocol Data Unit), which also contains a header of higher layer protocols. Using an in-depth header analysis, it is possible, in the similar way to

An analytical description of network traffic does not exist, because we cannot predict the size and arrival time of the next packet. Therefore, we can only describe network traffic as a stochastic process. Hence, we have tried to describe these two stochastic processes (arrival

In the 1990s, new descriptions and models of network's traffic were developed, which then replaced the traditional traffic models, such as Poisson and Markov [5], [20]. The Poisson process was widely used in the past, because it gave a good approximation of telephone network (PSNT networks), especially when describing times between each call and call durations. This model is usually described by exponential probability distribution, which is characterized by the parameter *λ* (number of events per second). However, these models do not allow for descriptions of bursts, which are distinctive in today's network traffic. Such

time and packet size) with the use of Hurst parameter and probability distributions.

the IP header, to calculate the lengths of all these headers.

**2.2 Self-similarity** 

The definition of self-similarity is usually based on fractals for the standard stationary time series [5], [6], [21].

Let *X* = (*Xt*, *t* = 0, 1, 2,…) be a covariance stationary stochastic process; that is a process with a constant mean, finite variance *σ2* = *E*[(*Xt* – *µ*)2], with auto-covariance function *γ*(*k*) = *E*[(*Xt* – *µ*)(*Xt*+*k* – *µ*)], that depends only on *k*. Then the autocorrelation function *r*(*k*) is:

$$r(k) = \frac{\mathcal{I}(k)}{\sigma^2} = \frac{E\left[ (X\_t - \mu)(X\_{t+k} - \mu) \right]}{E\left[ (X\_t - \mu)^2 \right]}, \qquad k = 0, 1, 2, \dots \tag{1}$$

Assume *X* has an autocorrelation function, which is asymptotically equal to:

$$\text{For}(k) = k^{-\mathcal{H}} L\_1(k), \quad k \to \ast \ast, \quad 0 < \mathcal{J} < 1,\tag{2}$$

where *L*1(*k*) slowly varies at infinity, that is 1 1 lim( ( ) / ( )) <sup>1</sup> *<sup>t</sup> L tx L t* →∞ = for all x > 0. Such functions are for example *L*1(*t*) = *const.* and *L*1(*t*) = log(*t*)) [5], [6].

The measure of self-similarity is the Hurst parameter (*H*), which is in a relationship with the parameter *β* in equation (3).

$$H = 1 - \frac{\beta}{2} \tag{3}$$

Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool 357

For values 0.5 < *H* < 1 autocorrelation function *r*(*k*) behavior, in an asymptotic mean, as *ck*-*<sup>β</sup>*

( )

The autocorrelation function decays hyperbolically, as the *k* increases, which means that autocorrelation function is non-summable. This is opposite to the property of short-range dependence (SRD), where the autocorrelation function decays exponentially and the equation (9) has a finite value. Short and long-range dependence have a common relationship with the value of the Hurst parameter of the self-similar process [6], [21]:

Fig. 3. Comparison between autocorrelation function of short range dependence process

(left) and autocorrelation function of long range dependence process (right) [15].

*r k* ∞

*k*

=−∞

for values 0 < *β* < 1, where *c* is constant *c* > 0, *β* = 2 - 2*H*, and we have:

• 0 < *H* < 0.5 →SRD - Short Range Dependence • 0.5 < *H* < 1 →LRD - Long Range Dependence

2 2 () ( ) , 2 1 *<sup>H</sup> rk H H k r* − − ≈ − → ∞ (8)

= ∞ . (9)

For 0 < *H* < 1, *H* ≠ 1/2 it holds [6]

Let's define the aggregation process for the time series [5], [6]:

For each *m* = 1, 2, 3, … let *X*(*<sup>m</sup>*) = (*Xk* (*<sup>m</sup>*), *k* = 1,2,..*m*) denote a new time series obtained by averaging the original series *X* over a non-overlapping block of size *m*. That is, for *m*=1, 2, 3, …, *X*(*<sup>m</sup>*) is given by:

$$X\_k^{(m)} = \frac{1}{m}(X\_{km-m+1} + \dots + X\_{km}), \qquad k = 1, 2, 3, \dots \tag{4}$$

*Xk* (*m*) is the process with average mean and autocorrelation function *r*(*m*) (*k*) [6].

The process *X* is called an exactly second order with parameter *H*, which represents the measure of self-similarity if the corresponding aggregated *X*(*<sup>m</sup>*) has the same correlation structures as *X* and ( ) <sup>2</sup> var( ) *<sup>m</sup> X m* β σ<sup>−</sup> = for all *m* = 1, 2, … :

$$r^{\{m\}}(k) = r(k), \text{ for all } \ m = 1, 2, \dots \quad k = 1, 2, \dots \tag{5}$$

The process *X* is called an asymptotically second order with parameter *H* = 1 – *β*/2, if for all *k* it is large enough,

$$r^{\langle m\rangle}(k) \to r(k), \qquad m \to \ast \tag{6}$$

It follows from definitions that the process is the second order self-similar in the exact or asymptotical sense, if their corresponding aggregated process *X*(*<sup>m</sup>*) is the same as *X* or becomes indistinguishable from *X*-at least with respect to their autocorrelation function. The most striking property in both cases, exact and asymptotical self-similar processes, is that their aggregated processes X(*m*) possess a no degenerate correlation structure as *m* → ∞. This contrasts with the Poisson stochastic models, where their aggregated processes tend to second order pure noise as *m* → ∞:

$$r^{(m)}(k) \to 0, \quad m \to \ast \ast, \quad k = 0, 1, 2, \dots \tag{7}$$

Network traffic with bursts is self-similar, if it shows bursts over many time scales, or it can be also said over a wide-range of time scales. This contrasts with traditional models such as Poisson and Markov, where their aggregation processes become very smooth.

#### **2.4 Long-range dependence**

The self-similar process can also contain a property of long-range dependence [5]-[8]. Long range dependence describes the memory effect, where a current value strongly depends upon the past values, of a stochastic process, and it is characterized by its autocorrelation function. This property has a stochastic process, which satisfies relation (2), order with relation *r*(*k*) = *γ*(*k*)/*σ*2.

For 0 < *H* < 1, *H* ≠ 1/2 it holds [6]

356 Telecommunications Networks – Current Status and Future Trends

The measure of self-similarity is the Hurst parameter (*H*), which is in a relationship with the

1 2

averaging the original series *X* over a non-overlapping block of size *m*. That is, for *m*=1, 2, 3,

<sup>1</sup> <sup>123</sup> ( ) ( ... ), , , , ... *<sup>m</sup> XX X k <sup>k</sup> km m km*

The process *X* is called an exactly second order with parameter *H*, which represents the measure of self-similarity if the corresponding aggregated *X*(*<sup>m</sup>*) has the same correlation

The process *X* is called an asymptotically second order with parameter *H* = 1 – *β*/2, if for all

It follows from definitions that the process is the second order self-similar in the exact or asymptotical sense, if their corresponding aggregated process *X*(*<sup>m</sup>*) is the same as *X* or becomes indistinguishable from *X*-at least with respect to their autocorrelation function. The most striking property in both cases, exact and asymptotical self-similar processes, is that their aggregated processes X(*m*) possess a no degenerate correlation structure as *m* → ∞. This contrasts with the Poisson stochastic models, where their aggregated processes tend to

Network traffic with bursts is self-similar, if it shows bursts over many time scales, or it can be also said over a wide-range of time scales. This contrasts with traditional models such as

The self-similar process can also contain a property of long-range dependence [5]-[8]. Long range dependence describes the memory effect, where a current value strongly depends upon the past values, of a stochastic process, and it is characterized by its autocorrelation function. This property has a stochastic process, which satisfies relation (2), order with

Poisson and Markov, where their aggregation processes become very smooth.

<sup>−</sup> = for all *m* = 1, 2, … :

β

= − (3)

(*k*) [6].

(*<sup>m</sup>*), *k* = 1,2,..*m*) denote a new time series obtained by

= ++ = − + (4)

( )( ) ( ), *<sup>m</sup> r k rk* <sup>=</sup> for all *m k* = = 12 12 , , ... , , ... (5)

( )( ) ( ), *<sup>m</sup> r k rk m* → → ∞ (6)

<sup>0</sup> <sup>012</sup> ( )( ) , , , , ,... *<sup>m</sup> rk m k* → →∞ = (7)

*H*

1

is the process with average mean and autocorrelation function *r*(*m*)

β

Let's define the aggregation process for the time series [5], [6]:

*m*

σ

parameter *β* in equation (3).

…, *X*(*<sup>m</sup>*) is given by:

*k* it is large enough,

*Xk* (*m*)

For each *m* = 1, 2, 3, … let *X*(*<sup>m</sup>*) = (*Xk*

structures as *X* and ( ) <sup>2</sup> var( ) *<sup>m</sup> X m*

second order pure noise as *m* → ∞:

**2.4 Long-range dependence** 

relation *r*(*k*) = *γ*(*k*)/*σ*2.

$$r(k) = H(2H - 1)k^{-2H - 2}, \qquad r \to \infty \tag{8}$$

For values 0.5 < *H* < 1 autocorrelation function *r*(*k*) behavior, in an asymptotic mean, as *ck*-*<sup>β</sup>* for values 0 < *β* < 1, where *c* is constant *c* > 0, *β* = 2 - 2*H*, and we have:

$$\sum\_{k=-\infty}^{\infty} r(k) = \Leftrightarrow \cdot \tag{9}$$

The autocorrelation function decays hyperbolically, as the *k* increases, which means that autocorrelation function is non-summable. This is opposite to the property of short-range dependence (SRD), where the autocorrelation function decays exponentially and the equation (9) has a finite value. Short and long-range dependence have a common relationship with the value of the Hurst parameter of the self-similar process [6], [21]:


Fig. 3. Comparison between autocorrelation function of short range dependence process (left) and autocorrelation function of long range dependence process (right) [15].

Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool 359

Another very important heavy-tailed distribution is Weibull distribution, which is described

α

α

<sup>−</sup> <sup>−</sup> =⋅ ⋅ ≥ > (11)

<sup>1</sup> ( ) ( ) , 0, , 0 *x*

where parameter *α* presents the shape parameter, and *k* presents the local parameter of

*<sup>k</sup> x p x ex k*

Fig. 5. Probability density function and cumulative distribution function of Weibull distribution for various shape parameters *α* and constant location parameter *k* [44].

α

*k k*

α

by [44]:

distribution.

#### **2.5 Heavy-tailed distributions**

Self-similar processes can be described by heavy-tailed distributions [5], [6], [9]. The main property of heavy-tailed distributions is that they decay hyperbolically, which is opposite to the light-tailed distribution, which decays exponentially. The simplest heavy-tailed distribution is Pareto. The probability density function of Pareto distribution is given by [43]:

$$p(\mathbf{x}) = \frac{\alpha k^{\alpha}}{\mathbf{x}^{\alpha+1}}, \quad k \le \mathbf{x}, \quad \alpha, k > 0 \tag{10}$$

where parameter *α* represents the shape parameter, and *k* represents the local parameter of distribution (also a minimum possible positive value of the random variable *x*).

Fig. 4. Probability density function and cumulative distribution function of Pareto distribution for various shape parameters α and constant location parameter *k* = 1 [43].

Self-similar processes can be described by heavy-tailed distributions [5], [6], [9]. The main property of heavy-tailed distributions is that they decay hyperbolically, which is opposite to the light-tailed distribution, which decays exponentially. The simplest heavy-tailed distribution is Pareto. The probability density function of Pareto distribution is given by

<sup>1</sup> () , , , 0 *<sup>k</sup> px k x k*

where parameter *α* represents the shape parameter, and *k* represents the local parameter of

α

<sup>+</sup> = ≤> (10)

*x*

distribution (also a minimum possible positive value of the random variable *x*).

Fig. 4. Probability density function and cumulative distribution function of Pareto distribution for various shape parameters α and constant location parameter *k* = 1 [43].

α

α

α

**2.5 Heavy-tailed distributions** 

[43]:

Another very important heavy-tailed distribution is Weibull distribution, which is described by [44]:

$$p(\mathbf{x}) = \frac{\alpha}{k} \cdot \left(\frac{\mathbf{x}}{k}\right)^{\alpha - 1} \cdot e^{-(\frac{\mathbf{x}}{k})^{\alpha}}, \quad \mathbf{x} \ge \mathbf{0}, \quad \alpha, k > 0 \tag{11}$$

where parameter *α* presents the shape parameter, and *k* presents the local parameter of distribution.

Fig. 5. Probability density function and cumulative distribution function of Weibull distribution for various shape parameters *α* and constant location parameter *k* [44].

Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool 361

Let's define network traffic on higher layers (application) of ISO/OSI model. Data source network traffic Z*d*[*n*] can be described as a composite of data source lengths *Xd*[*n*] and data

To provide statistical equality between packet network traffic *Zp*[*n*] and data sources network traffic Z*d*[*n*], we have performed a transformation between packet size process *Xp*[*n*] and the process of data length *Xd*[*n*] as well as transformation between packet inter-

[ ] [ ] *transformation*

[ ] [ ] *transformation*

Transformation (19) and (20) allows estimation of packet traffic processes from data source

Hurst's parameter represents the measure of self-similarity. There are several methods for estimating Hurst's parameter (*H*) [1]-[4] of stochastic self-similar processes. However, there are no criteria as to which method gives the best results. There are several different methods for estimating the Hurst parameter which can lead to diverse results [9], [10]. This is the reason why Hurst's parameter cannot be calculating but can be estimated. The most often

• Variance method is a graphical method, which is based on the property of slowly decaying variance. In a log-log scale plot, a sample variance versus a non-overlapping block of size m is drawn for each aggregation level. From the line with slope *β* we can

• R/S method is also a graphical method. It is based on a range of partial sums regarding data series deviations from mean value, rescaled by its standard deviation. The slope in the log-log plot of the R/S statistic versus aggregated points is the estimation for

• Periodogram method plots spectral density in a logarithm scale versus frequency (also in logarithm scale). The slope in periodogram allows the estimation of parameter *H*. Figure 6 presents an example of test traffic and estimations of Hurst's parameter through

*Y n Yn pm ps* [ ] <sup>≈</sup> [ ] (17)

[ ] [ ] [ ], *Zn Xn Yn n d dd* = ∈ (18)

*X n pm* ←⎯⎯⎯⎯⎯ ⎯⎯⎯⎯⎯⎯⎯→*X n <sup>d</sup>* (19)

*Y n pm* ←⎯⎯⎯⎯⎯ ⎯⎯⎯⎯⎯⎯⎯→*Y n <sup>d</sup>* (20)

and

inter-arrival times *Yd*[*n*] processes:

traffic processes or vice verse.

Hurst's parameter.

different methods.

**3.1 Hurst parameter estimations** 

arrival time *Yp*[*n*] and data inter-arrival time *Yd*[*n*].

**3. Network traffic analysis and modeling** 

used methods for Hurst's parameter estimation are [6], [8], [21]:

estimate Hurst's parameter as a relationship, from equation (3).

#### **2.6 Network traffic definitions**

The network traffic can be observed on different layers of ISO/OSI model, for that reason we define different kinds of network traffics. The network traffic can be represented as a stochastic process, which can be interpreted as the traffic volume – measured in packets, bytes or bits per time unit, and it is consequent on data or packets, which are sent through the network in time unit. If we observe network traffic on the low level of ISO/OSI model, then define the packet network traffic [45] *Zp*[*n*]:

Let define the packet network traffic *Zp*[*n*] as a stochastic process interpreted as the traffic volume, measured in packets per time unit. *Zp*[*n*] can be described as a composite of two stochastic processes:

$$X\_p[n] = X\_p[n] \circ Y\_p[n], \quad n \in \mathbb{R} \tag{12}$$

where *Xp*[*n*] represents packet size process and *Yp*[*n*] represents the packet inter-arrival time.

Packet-size process *Xp*[*n*] is defined as a series of packet sizes *lPi* measured in bits (b) or bytes (B).

$$X\_p\begin{bmatrix} n \end{bmatrix} = \{l\_{P1}, l\_{P2}, \dots l\_{Pi}, \dots, l\_{Pn}\}, \quad 1 \le i \le n \tag{13}$$

where sizes of packets' *lPi* are limited by the shortest *lm* and the longest *lMTU* packet size (MTU - Maximum Transmission Unit).

$$l\_m \le l\_{Pi} \le l\_{MTLI} \tag{14}$$

Packet inter-arrival time process *Yp*[*n*] is defined as a series of times between packet arrivals *tPi* (time stamps).

$$\begin{aligned} \mathbf{Y}\_p[n] &= \left\{ \mathbf{t}\_{p2} - \mathbf{t}\_{p1}, \dots, \mathbf{t}\_{Pi} - \mathbf{t}\_{pi-i}, \dots, \mathbf{t}\_{Pn} - \mathbf{t}\_{Pn-i} \right\}, \quad 1 \le i \le n \\\ &= \left\{ \Delta t\_{p1'} \Delta t\_{p2'}, \dots \Delta t\_{pi'}, \dots \Delta t\_{pn-1} \right\}, \quad 1 \le i \le n \end{aligned} \tag{15}$$

The measured network traffic is packet network traffic, which can be captured using special software program or hardware devices. For that reason, the measured network traffic is marked as *Zpm*[*n*]. We also define modeled (simulated) network traffic as *Zps*[*n*]. We suppose, that the measured and modeled traffic is statistically equal, denoted by the symbol ≈,

$$\mathcal{Z}\_{\text{pm}}\left[\boldsymbol{n}\right] = \mathcal{Z}\_{\text{ps}}\left[\boldsymbol{n}\right] \tag{16}$$

if there are also statistical equalities between a packet size and inter-arrival time processes of measured, and modeled traffic.

$$\mathcal{X}\_{pm}[n] = \mathcal{X}\_{ps}[n]$$

and

360 Telecommunications Networks – Current Status and Future Trends

The network traffic can be observed on different layers of ISO/OSI model, for that reason we define different kinds of network traffics. The network traffic can be represented as a stochastic process, which can be interpreted as the traffic volume – measured in packets, bytes or bits per time unit, and it is consequent on data or packets, which are sent through the network in time unit. If we observe network traffic on the low level of ISO/OSI model,

Let define the packet network traffic *Zp*[*n*] as a stochastic process interpreted as the traffic volume, measured in packets per time unit. *Zp*[*n*] can be described as a composite of two

where *Xp*[*n*] represents packet size process and *Yp*[*n*] represents the packet inter-arrival time. Packet-size process *Xp*[*n*] is defined as a series of packet sizes *lPi* measured in bits (b) or bytes

[ ] { } 1 2 , ,... ,..., , 1 *Xn l l l l in p P P Pi Pn* = ≤ ≤

where sizes of packets' *lPi* are limited by the shortest *lm* and the longest *lMTU* packet size

Packet inter-arrival time process *Yp*[*n*] is defined as a series of times between packet arrivals

*Yn t t t t t t i n*

−

The measured network traffic is packet network traffic, which can be captured using special software program or hardware devices. For that reason, the measured network traffic is marked as *Zpm*[*n*]. We also define modeled (simulated) network traffic as *Zps*[*n*]. We suppose, that the measured and modeled traffic is statistically equal, denoted by the symbol

if there are also statistical equalities between a packet size and inter-arrival time processes of

*X n Xn pm ps* [ ] <sup>≈</sup> [ ]

1

− −

=Δ Δ Δ Δ ≤≤ (15)

,..., ,..., ,

= − − − ≤≤

[ ] { }

*t t t t in*

*p P P Pi pi i Pn Pn i*

{ } 2 1

*p p pi pn*

1 2 1

, ,..., ,..., ,

[ ] [ ] [ ], *Zn Xn Yn n p pp* = ∈ . (12)

*lll m Pi MTU* ≤ ≤ (14)

1

*Z n Zn pm ps* [ ] <sup>≈</sup> [ ] (16)

(13)

**2.6 Network traffic definitions** 

stochastic processes:

*tPi* (time stamps).

(B).

≈,

then define the packet network traffic [45] *Zp*[*n*]:

(MTU - Maximum Transmission Unit).

measured, and modeled traffic.

$$\mathcal{Y}\_{pm}\begin{bmatrix} n \end{bmatrix} = \mathcal{Y}\_{ps}\begin{bmatrix} n \end{bmatrix} \tag{17}$$

Let's define network traffic on higher layers (application) of ISO/OSI model. Data source network traffic Z*d*[*n*] can be described as a composite of data source lengths *Xd*[*n*] and data inter-arrival times *Yd*[*n*] processes:

$$X\_d[n] = X\_d[n] \circ Y\_d[n], \quad n \in \mathbb{R} \tag{18}$$

To provide statistical equality between packet network traffic *Zp*[*n*] and data sources network traffic Z*d*[*n*], we have performed a transformation between packet size process *Xp*[*n*] and the process of data length *Xd*[*n*] as well as transformation between packet interarrival time *Yp*[*n*] and data inter-arrival time *Yd*[*n*].

$$X\_{pm}\left[n\right] \xleftarrow{transformation} X\_d\left[n\right] \tag{19}$$

$$Y\_{pm}\left[n\right] \xleftarrow{\text{transformation}} Y\_d\left[n\right] \tag{20}$$

Transformation (19) and (20) allows estimation of packet traffic processes from data source traffic processes or vice verse.

#### **3. Network traffic analysis and modeling**

#### **3.1 Hurst parameter estimations**

Hurst's parameter represents the measure of self-similarity. There are several methods for estimating Hurst's parameter (*H*) [1]-[4] of stochastic self-similar processes. However, there are no criteria as to which method gives the best results. There are several different methods for estimating the Hurst parameter which can lead to diverse results [9], [10]. This is the reason why Hurst's parameter cannot be calculating but can be estimated. The most often used methods for Hurst's parameter estimation are [6], [8], [21]:


Figure 6 presents an example of test traffic and estimations of Hurst's parameter through different methods.

Modeling and Simulating the Self-Similar Network Traffic in Simulation Tool 363

Fig. 7. For the stochastic process of inter-arrival time, distribution and estimate parameters of these distributions are chosen based on the histogram (upper left), and cumulative distribution function (upper right). Differences between empirical and theoretical distributions in P-P plot (lower left), and deferential distribution (lower right).

One of the very important tasks in simulation is modeling the real network parameters and network elements for simulation purposes. The main goal in successful modeling of network traffic is to minimize discrepancies between the measured simulations and by simulations statistically-modeled and generated traffic. This means, that both traffics are similar within the different criteria, such as bit and packet-rate, bursts (Hurst's parameter),

Network traffic simulations are usually based on modeling of data sources or applications. One of the most known simulation tools is OPNET Modeler [22], [23]. A simulation of network traffic in this tool is based on the "on/off" models [41] or more often used traffic generators. Difference between these manners is in a modeling manner. In the first case, the arrival process is described by Hurst's parameter (*H*) and the data length process is

**4. Simulation of network traffic in simulation tools** 

variance, etc.

Fig. 6. Estimating parameter *H* for self-similar traffic (upper-left) with the variances method (lower left), R/S method (upper-right) and periodogram method (lower-right) using SELFIS tool [8].
