Network traffic measurement supports fundamental network management tasks like “capacity planning, accounting and billing, anomaly detection, and service provision.” This book presents several online measurement methods.
Basically, the authors have structured the book into four chapters. The first introductory chapter gives a detailed motivation for the challenging task of keeping the measurement module compact and fast for real-time data extraction. This is important to “keep up with the line speed of modern routers.” Furthermore, it provides a brief introduction to three “fundamental online functions: per-flow size estimators, spread estimators, and origin-destination flow estimators.” These three measurement functions are described in detail in the following three chapters.
In chapter 2, the authors present their approach, which delivers good performance in tight memory space. After presenting the performance metrics and system design, as well as the online data encoding module, two offline data decoding modules are described: an offline counter sum estimator and a maximum likelihood estimator; both are based on the randomized counter sharing scheme. The approaches are checked with regard to effectiveness and efficiency using real network traffic traces, and they are compared with two other existing methods (counter braids and multi-resolution space-code bloom filters). In addition, setting the counter length and extending the estimation range of flows are discussed.
Chapter 3 discusses the problem of spreader classification. “The spread of a source is the number of destinations contacted by the source,” and the spread of a destination is defined in an analogue way. This information can be used in intrusion detection systems and to determine the popularity of a server’s content. After a brief problem statement, the authors present an efficient spreader classification scheme, providing an efficient estimator based on dynamic bit sharing. The estimator applies a maximum likelihood estimation method. In a separate subsection, the analytical results for optimal parameters are outlined--the corresponding algorithms are included as an appendix to the chapter. Again, the performance of the approach is evaluated and compared with existing methods, including the two-level filtering algorithm, the thresholded bitmap algorithm, and the compact spread estimator. Whereas the first part of the chapter concentrates on heavy spreader classification, a method for multi-objective spreader classification is presented toward the end.
Origin-destination (OD) flow estimators are used to measure the size of an OD flow between two routers, which is important information for many network management applications. Chapter 4 presents an appropriate method. After presenting the problem, the performance metrics used (measurement efficiency and accuracy) are presented. A new statistical interference approach is outlined, which should “achieve accurate measurement results with small bias and standard deviation.” The approach is evaluated using simulation and “experimental results based on real traffic traces.” In both cases, the approach is also compared with the quasi-maximum likelihood estimate (QMLE).
In summary, this well-structured text on efficient online network traffic measurement presents the material--both the conceptual and theoretical, as well as the experimental parts--in a very readable way. Each of the four chapters ends with a list of highly relevant references.
