Aggregated Impulses: Towards Explanatory Models for Self-Similar Alpha Stable Network Traffic

Heavy-tailed models of computer network traffic have been shown to more accurately reflect the actual traffic distributions of many traffic features than methods based on exponential distributions. The power-law tail inherent to alpha-stable distributions better accommodates network traffic properties such as impulsiveness, self-similarity, and long-range dependence, enabling more precise models and more accurate network anomaly detection. Beginning from individual traffic processes, this work presents two explanatory mathematical methods for device aggregation which lead to either Gaussian or alpha-stable traffic distributions. The first method, based on the generalized central limit theorem, shows how self-similarity originates from an impulsive-noise-based representation of individual processes. A second method based on renewal theory supports the predictions of the first method and explains aggregation, in some networks, to Gaussian fractional Brownian motion. We develop working models to empirically validate the proposed approaches which can forecast the resulting aggregation based on the characteristics of the input devices.