Realistic Internet traffic simulation through mixture modeling and a case study

Internet background traffic modeling and simulation is the main challenge when constructing a test environment for network intrusion detection experiments. However, a realistic simulation of network traffic through analytical models is difficult, because the classic distributions are usually ineffective when applied to traffic-related random variables. A modeling and simulation approach using heavy-tailed mixture distributions is introduced in this paper. In the case study, this approach is used to build analytical models for random variables of several major Internet applications (FTP, HTTP, SMTP, POP3, SSH) of a campus network. Several statistical features of an NS2 simulation are compared against those of the traffic traces being simulated. The comparison indicates that the simulation is statistically similar to the real traffic.