Cluster processes: a natural language for network traffic

We introduce a new approach to the modeling of network traffic, consisting of a semi-experimental methodology combining models with data and a class of point processes (cluster models) to represent the process of packet arrivals in a physically meaningful way. Wavelets are used to examine second-order statistics, and particular attention is paid to the modeling of long-range dependence and to the question of scale invariance at small scales. We analyze in depth the properties of several large traces of packet data and determine unambiguously the influence of network variables such as arrival patterns, durations, and volumes of transport control protocol (TCP) flows and internal flow structure. We show that session-level modeling is not relevant at the packet level. Our findings naturally suggest the use of cluster models. We define a class where TCP flows are directly modeled, and each model parameter has a direct meaning in network terms, allowing the model to be used to predict traffic properties as networks and traffic evolve. The class has the key advantage of being mathematically tractable, in particular, its spectrum is known and can be readily calculated, its wavelet spectrum deduced, interarrival distributions can be obtained, and it can be simulated in a straightforward way. The model reproduces the main second-order features, and results are compared against a simple black box point process alternative. Discrepancies with the model are discussed and explained, and enhancements are outlined. The elephant and mice view of traffic flows is revisited in the light of our findings.