Automated Identification of BBR Traffic based on Packet Inter-Arrival Times Analysis

The Internet is a complex and constantly evolving system, and congestion control algorithms play a crucial role in ensuring its functioning by managing network performance. These algorithms regulate the flow of data within a network and optimize data transmission for efficiency and effectiveness. They do this by continuously estimating available network resources and adjusting the data transmission rate accordingly.For network operators, identifying the congestion control algorithms being used on their network is essential to gain valuable insights into network performance and device behavior. This information can help them gain a better understanding of how the network is being utilized and which algorithms are most effective in different scenarios. With a clear understanding of the congestion control algorithms in use, they can make decisions about network design, configuration, and management.Nowadays, over 85% of total Internet traffic is TCP traffic. TCP uses different congestion control algorithms, of which BBR and CUBIC represent 73% of the total TCP traffic. In this work, we present a method for automatically identifying BBR traffic on the Internet. Our method relies on analyzing packet inter-arrival times, specifically comparing the distribution of packet inter-arrival times during the Slow-Start state of a BBR capture with those of a CUBIC capture. We introduce a model that allows us to detect the silence period after packet bursts that are present in almost all non-BBR congestion control algorithms. This method is characterized by a very simple frontend signal processing that exploits the algorithms’ core principles, allowing for a tiny parameter space dimension (two), which is sufficient for robust discrimination: an error rate of 4.1% was obtained on a test dataset independent from training.