1: %% LyX 1.3 created this file. For more info, see http://www.lyx.org/.
2: %% Do not edit unless you really know what you are doing.
3: \documentclass{IEEEtran}
4: \usepackage[T1]{fontenc}
5: \usepackage{amsmath}
6: \usepackage{graphicx}
7:
8: \makeatletter
9: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Textclass specific LaTeX commands.
10: \newcommand{\lyxaddress}[1]{
11: \par {\raggedright #1
12: \vspace{1.4em}
13: \noindent\par}
14: }
15:
16: \makeatother
17: \begin{document}
18:
19: \title{Delayed Correlations in Inter-Domain Network Traffic}
20:
21:
22: \author{Viktoria Rojkova, Mehmed Kantardzic}
23:
24: \maketitle
25:
26: \lyxaddress{Department of Computer Engineering and Computer Science, University
27: of Louisville, Louisville, KY 40292 email: \{vbrozh01, mmkant01\}@louisville.edu }
28:
29: \begin{abstract}
30: To observe the evolution of network traffic correlations we analyze
31: the eigenvalue spectra and eigenvectors statistics of delayed correlation
32: matrices of network traffic counts time series. Delayed correlation
33: matrix $D\left(\tau\right)$ is composed of the correlations between
34: one variable in the multivariable time series and another at a time
35: delay $\tau$. We determined, that inverse participation ratio (IPR)
36: of eigenvectors of $D\left(\tau\right)$ deviates substantially from
37: that of eigenvectors of the equal time correlation matrix. The largest
38: eigenvalue $\lambda_{max}$ of $D\left(\tau\right)$ and the corresponding
39: IPR oscillate with two characteristic periods of $3\tau$ and $6\tau$.
40: Found delayed correlations between network time series fits well into
41: the long range dependence (LRD) property of the network traffic.
42:
43: Injecting the random traffic counts between non-randomly correlated
44: time series, we were able to break the picture of periodicity of $\lambda_{max}$.
45: In addition, we investigated influence of the periodic injections
46: on both largest eigenvalue and the IPR, and addressed relevance of
47: these indicators for the LRD and self-similarity of the network traffic.
48: \end{abstract}
49:
50: \section*{Categories and Subject Descriptors}
51:
52: C.2.3 {[}\textbf{Computer-Communication Networks}{]}: Network Operations
53:
54:
55: \section*{General Terms}
56:
57: Measurement, Experimentation
58:
59: \begin{keywords}
60: Network-Wide Traffic Analysis, Random Correlations, Time-Lagged Correlations,
61: Long Range Dependence
62: \end{keywords}
63:
64: \section{introduction}
65:
66: The cross-correlation matrix is one of the tools of time series analysis,
67: used in studies of the underlying interactions between network structural
68: constituents. The network traffic system is often seen as a collection
69: of times series with traffic bytes per time interval or number of
70: packets per time interval at a single link. Within this collection,
71: temporal correlations between network structural constituents and
72: consequently patterns of collective behavior might be present.
73:
74: To study such patterns one can employ the equal-time cross-correlation
75: matrix of traffic time series at all network links (see, for example
76: \cite{Rojkova,Barthelemy}). Further statistical description of the
77: awareness is commonly done via eigen-decomposition of cross-correlation
78: matrix. Detailed studies showed that the major portion of eigenvalues
79: of cross-correlation matrix fall into the theoretically predicted
80: boundaries of eigenvalues spectrum of random matrices \cite{Rojkova,Barthelemy}.
81: This portion satisfies the so called universal properties described
82: by the random matrix theory (RMT) \cite{Guhr3}. It also recognizes
83: the uncongested state of the traffic, where each router is able to
84: communicate with any other router and with each subnet under its service.
85: The part of the spectrum deviating from the RMT boundaries represents
86: stable in time non-random correlations between network traffic time
87: series \cite{Rojkova,Barthelemy}.
88:
89: Even though, such distinction provides a valuable insight into the
90: meaning of empirical data, the equal-time cross-correlation matrix
91: on its own may not be sufficient for understanding of the effect of
92: inter-domain correlations at different times. In fact, the analysis
93: of correlation as a function of time lags has already been used in
94: econometric time series systems. For example, the analysis of stock
95: returns portfolio showed the asymmetric lead-lag relationship between
96: stock returns; high-volume stocks lead the low-volume stocks \cite{Lo,Chordia}.
97: This finding is attributed to information adjustment asymmetry \cite{Biely}.
98: The uncongested balanced state of the network traffic implies the
99: \char`\"{}symmetric\char`\"{} information/traffic flow exchange. Thus,
100: to control the congestion level of network traffic systems, it is
101: crucial to recognize the collective behavior or correlation patterns
102: between network traffic time series, and to observe their evolution
103: in time.
104:
105: In order to trace the evolution of correlation pattern between traffic
106: time series the equal-time cross-correlation matrix is replaced with
107: time-lagged correlation matrix \cite{GlupyeIndusy}. The obtained
108: matrix of delayed correlations $D\left(\tau\right)$ can be subjected
109: to eigen-analysis just like its equal-time counterpart. In contrast
110: to equal-time correlation matrices which have a real eigenvalue spectrum,
111: the spectrum of $D\left(\tau\right)$ is complex since matrices of
112: these types are asymmetric. While the general properties of complex
113: spectrum of $D\left(\tau\right)$ is unknown so far, results of symmetrized
114: version of lagged correlation matrices have been reported recently
115: \cite{GlupyeIndusy,Burda}.
116:
117: In this paper, we concentrated on time-lagged correlations between
118: time series generated by Simple Network Manage Protocol (SNMP) traffic
119: counters of University of Louisville backbone routers system. We established
120: that time-lagged correlations between traffic time series sustain
121: for up to $100\tau$, where $\tau=300$ sec. Moreover, the largest
122: and smallest eigenvalues $\lambda_{max}$ and $\lambda_{min}$ of
123: $D\left(\tau\right)$ and the inverse participation ratio (IPR) of
124: the eigenvector corresponding to $\lambda_{max}$ were found to oscillate
125: with two characteristic periods of $3\tau$ and $6\tau$.
126:
127: In addition, within the content of the eigenvector corresponding to
128: $\lambda_{max}$ we determined the index of a single time series which
129: is driving the $\lambda_{max}$ oscillation. The IPR of all eigenvectors
130: of $D\left(\tau\right)$ shows the single time series contributor
131: in the eigenvector which at the equal-time correlations belonged to
132: the random part of the spectrum. Since the theoretical prediction
133: for the spectrum of time-lagged correlation matrices is unknown, we
134: keep the terminology of the spectrum derived from eigen-decomposition
135: of equal-time correlation matrices. Thus, \emph{random} in our text
136: refers to the part of the spectrum within the boundaries predicted
137: by the RMT for equal-time correlation matrix. \emph{Non-random} denotes
138: the part of the spectrum outside of the RMT predictions.
139:
140: Finally, we found that the injection of random traffic counts between
141: time series which interact \emph{non-randomly} destroys the oscillatory
142: picture of $\lambda_{max}$ and $\lambda_{min}$ and that of the corresponding
143: IPRs. Meanwhile, the injection of traffic counts with smooth (periodic)
144: time dependence between \emph{randomly} interacting traffic time series
145: with respect to characteristic periods of $\lambda_{max}$, $\lambda_{min}$
146: and IPR reveals new periodicity (of $4\tau$). The findings of eigenvalue
147: spectrum analysis and experimental results suggest the asymmetric
148: long lasting relationship between traffic time series.
149:
150: Network traffic analysis had undergone the evolution from considering
151: the network traffic time series as an outcome of Poisson and memory-less
152: processes to recognizing the long range dependencies and self-similarity
153: of the traffic. The statistics of eigenvalue spectrum and IPR of eigenvectors
154: of time-lagged correlation matrices provide essential dimensional
155: reduction in the investigation of long-ranged dependence (LRD) of
156: the network traffic. Before starting the expensive process of Hurst
157: parameter estimation, one can attempt to find just a few indicators
158: of LRD, self-similarity or deviations from thereof.
159:
160: The rest of the paper is organized as follows. We introduce time-lagged
161: correlation matrix and its eigensystem in Section II. Section III
162: is devoted to numerical analysis of time-lagged eigensystem. Then,
163: in Section IV by experimenting with the content of the original time
164: series we addressed LRD and self-similarity of lagged correlations
165: through proposed indicators. Conclusions and discussion are given
166: in Section V.
167:
168:
169: \section{time-lagged correlation matrix of network traffic time series}
170:
171: The starting point of our discussion is averaged traffic count data
172: collected from router-router and router-VLAN subnet connections of
173: the University of Louisville backbone routers system. The same data
174: set was used in \cite{Rojkova} in the context of equal-time correlation
175: matrix analysis. Below we recap the details relevant to the construction
176: of lagged correlation matrix, relegating the information on the network
177: and the way data was processed to \cite{Rojkova}. We will be dealing
178: with total of $L=2015$ records of $N=497$ time series averaged over
179: $300$ seconds, where incoming and outgoing traffic generate independent
180: time series.
181:
182: In order to define traffic rate change $G_{i}\left(t\right)$ we used
183: the logarithm of the ratio of two successive counts upon calculating
184: the traffic rate change of time series $T_{i}$, $i=1,\dots,N$ ,
185: over time $\Delta t$,\[
186: G_{i}\left(t\right)\equiv\textrm{ln}\, T_{i}\left(t+\Delta t\right)-\textrm{ln}\, T_{i}\left(t\right),\]
187: \cite{Barthelemy}. Then we introduce normalization, according to
188: $g_{i}\left(t\right)=\left(G_{i}\left(t\right)-\left\langle G_{i}\left(t\right)\right\rangle \right)/\sqrt{\left\langle G_{i}^{2}\right\rangle -\left\langle G_{i}\right\rangle ^{2}}$
189: and built the time-lagged correlation matrix $D\left(\tau\right)$
190: as follows \cite{GlupyeIndusy}\begin{align}
191: D_{ij}\left(\tau\right) & \equiv\textrm{{Sym}}\left\langle g_{i}\left(t\right)g_{j}\left(t+\tau\right)\right\rangle \nonumber \\
192: & =\frac{1}{2L}\sum_{t=0}^{t=L}\left(g_{i}\left(t\right)g_{j}\left(t+\tau\right)+g_{j}\left(t\right)g_{i}\left(t+\tau\right)\right).\label{DeeOfTau}\end{align}
193: Here the sole purpose of symmetrization is the restriction of the
194: eigenvalues and eigenvectors to real values. In principle, the numerical
195: experiments we run below can be repeated for the eigensystem of non-symmetric
196: correlation matrix. Studies of the latter are already in progress
197: in a different setting (see, for example, \cite{Biely}).
198:
199:
200: \subsection{Eigenvalues and eigenvectors}
201:
202: Next we proceed with defining the indicators we focus on in what follows.
203: First of all, the eigenproblem for our cross-correlation matrix is
204: time dependent\begin{equation}
205: D\left(\tau\right)u_{k}\left(\tau\right)=\lambda_{k}\left(\tau\right)u_{k}\left(\tau\right),\label{EigenProblem}\end{equation}
206: where $\lambda_{k}$ is $k$-th eigenvalue, corresponding to $k$th
207: eigenvector. In other words, the eigensystem $\left\{ \lambda_{k}\left(\tau\right),\, u_{k}\left(\tau\right)\right\} $
208: is defined for each increment of delay time. As opposed to same time
209: eigensystem $\left\{ \lambda_{k}\left(0\right),\, u_{k}\left(0\right)\right\} $,
210: our eigensystem does not characterize presence or lack of organization
211: (localization) in the system at a given time. Instead it can serve
212: as a measure of back-in-time (or forward in time, depending on prospective)
213: correlation within the network structure.
214:
215: Furthermore, the RMT picture of the eigenvalues and eigenvectors,
216: in which spectrum is split into three parts is no longer valid. By
217: three parts we understand the RMT part, which behave universally at
218: the center of the eigenvalue spectrum, and {}``left'' and {}``right''
219: parts (lying to the left and to the right from predicted RMT bounds)
220: which exhibit non-universal features \cite{Rojkova}. Although, for
221: very small $\tau$ this subdivision is clearly still accurate, we
222: can expect, transient behavior of $\left\{ \lambda_{k}\left(\tau\right),\, u_{k}\left(\tau\right)\right\} $
223: to reveal new, otherwise undetectable correlations within the network.
224: Hence, we found it convenient to keep track of quantitative and qualitative
225: changes in eigensystem using left/random/right terminological distinction.
226:
227: On the other hand, observing the entire system of $497$ eigenvalues
228: and the same amount of eigenvectors can be quite tedious task. One
229: needs to come up with more concise indicators of network behavior.
230: Selecting efficient indicators can help in defining {}``normal''
231: state of the system, a task quite challenging on its own, and in predicting
232: structural reaction to the external or internal disruption. Indicators
233: can be chosen based on the experiments described below, or on their
234: advanced variations. The candidates are those eigenvalues, that are
235: most receptive to a particular probe. As far as eigenvectors are concerned
236: we decided to test corresponding IPRs.
237:
238:
239: \subsection{Inverse participation ratio}
240:
241: Given the eigenvector $u_{k}\left(\tau\right)$ the IPR is computed
242: according to\begin{equation}
243: I_{k}\left(\tau\right)\equiv\sum_{l=1}^{N}\left[u_{k}^{l}\left(\tau\right)\right]^{4},\label{eq18}\end{equation}
244: with $u_{k}^{l}$, $l=1,\dots,497$ stands for components of the $k$th
245: eigenvector \cite{Guhr3}. The IPR is quite indicative in terms of
246: signaling the number of significant $u_{k}^{l}$, i.e. {}``contributors''
247: to the eigenvector of interest. For example, if we have reasons to
248: expect absence of correlations between routers input into the experimental
249: data, $I_{k}\left(0\right)$ should have its value around $1/\sqrt{N}$.
250: Indeed, the eigenvector is normalized, thus $\sum_{l=1}^{N}\left[u_{k}^{l}\left(\tau\right)\right]^{2}=1$.
251: It has $N$ components, and they are all roughly the same in magnitude
252: (otherwise correlations must be present). Therefore, $u_{k}^{l}\simeq1/\sqrt{N}$,
253: and $I_{k}\left(0\right)\simeq1/N$. Note, that since $N$ is typically
254: much greater than $1$, any finite value of IPR signals \emph{localization}
255: in inter-VLAN traffic \cite{Rojkova}. For non-zero values of $\tau$,
256: IPRs acquire more general meaning in a sense that routers which interact
257: heavily at time $t$ may loose their {}``bond'' at time $t+\tau$,
258: while these not knowing about one another at time $t$ may have significant
259: mutual contribution at time $t+\tau$. Other more complex possibilities
260: can be perceived via $I_{k}\left(\tau\right)$ as well.
261:
262:
263: \section{Eigenanalysis for time-lagged correlation matrix}
264:
265:
266: \subsection{Stroboscopic sequence for eigensystem}
267:
268: Upon building the cross-correlation matrix $D\left(\tau\right)$ with
269: the help of Eq. (\ref{DeeOfTau}) we perform eigen-decomposition (see
270: Eq. (\ref{EigenProblem})) numerically, using standard \emph{MATLAB}
271: routine. We look at the result of calculation of eigenvalues for all
272: delay times $\tau$. A noticeable spike for very small values of delay
273: time is expected, notwithstanding the position in spectrum. However,
274: our increments in $\tau$ ($=300\, sec$) may not be small enough
275: to observe it. For the remainder of observation the result has to
276: uncover the way system constituents communicate with themselves and
277: their neighbors on a long run.%
278: \begin{figure*}
279: \begin{center}\includegraphics{Delay1.eps}\end{center}
280:
281:
282: \caption{\label{1} (a) left, (b) random, and (c) right parts of the eigenvalue
283: spectrum as obtained from actual data. Same graphs are presented in
284: (d), (e), (f) respectively, after noise-like injections are made. }
285: \end{figure*}
286: %
287: \begin{figure*}[t]
288: \begin{center}\includegraphics{DelayIPR.eps}\end{center}
289:
290:
291: \caption{\label{2} (a) $I\left(0\right)$ versus position in spectrum. Stroboscopic
292: representation of IPRs corresponding to (b) first $10\tau$ (c) second
293: $10\tau$; (d)-(f) are the same representations upon noise-like injections.}
294: \end{figure*}
295: In Fig. \ref{1}(a)-(c) we illustrate how left/random/right structure
296: of the spectrum evolves with $\tau$. As it turns out, {}``randomness''
297: and {}``regularity'' find their new interpretations in the context
298: of system remembering itself after $\tau$ has elapsed. With the exception
299: of a few located at the right and left edges of the spectrum, most
300: eigenvalues fall very close to each other numerically. To make it
301: more transparent we plotted their $\tau$-dependence using different
302: offset values (these values are the same within each part). Only ten
303: eigenvalues are offseted in each case and plotted versus time. The
304: lowest eigenvalue was excluded from consideration here and throughout
305: the paper due to it secular behavior in $\tau$.
306:
307: At a glance, non-edge eigenvalues Fig. \ref{1}(b) with the exception
308: of an expected spike at small $\tau$ does not seem to represent any
309: process. Such a lack of forward in time correlation is not completely
310: surprising, as the eigenvalues from middle part of the spectrum were
311: referred as RMT-like. It follows, that the random interactions between
312: traffic time series are time delay invariant. In other words, random
313: spectrum of eigenvalues is an indicator of self-similarity \cite{Faloutsos}.
314: Meantime, the eigenvalues at the edges (Figs. \ref{1}(a) and (c))
315: represent a quasiperiodic process, distinguishing themselves from
316: their \char`\"{}peers\char`\"{}, the eigenvalues belonging to regular
317: part of the spectrum for $\tau=0$ quantitatively, and both qualitatively
318: and quantitatively from the eigenvalues belonging to the RMT-part
319: for $\tau=0$. They scale with delay time and clearly exhibit long
320: time dependence \cite{Faloutsos}. Therefore, it makes sense to look
321: further into the properties of edge eigenvalues, especially into the
322: properties of those with relatively high absolute values. The actual
323: values might be used as a measure of delayed time correlations. Having
324: located potential indicators we move ahead with the search for others.
325:
326: A remarkable property of the IPR for equal time cross-correlation
327: matrix (Fig. \ref{2}(a)) is its consistently low, order $1/N$, value
328: for the major part of the spectrum. This segment in Fig. \ref{2}(a)
329: is known to obey the RMT \cite{Rojkova}. To the left and to the right
330: from this segment there is a strong evidence of regular, non-random
331: behavior. Now, if the first $20$ instances are considered as in Figs.
332: \ref{2}(b) and (c), where IPRs offseted by an arbitrary amount for
333: transparency and plotted versus the eigenvalue position, the situation
334: looks drastically different. The peak located close to the center
335: of the spectrum signifies the presence of previously undetected correlations,
336: and the lead-lag relationship between time series.
337:
338: Close examination of Figs. \ref{2}(b) and (c) shows, that initially,
339: the high IPR has changing support in the spectrum. Furthermore, as
340: explained in Section 2.2, peak value tells us, that about four time
341: series drive the correlation pattern. Later on, the peak \char`\"{}settles
342: down\char`\"{} and establishes itself around median eigenvalue position
343: (Fig. \ref{2}(b)). The meaning of this and other two peaks differs
344: from that of the IPR peaks in Fig. \ref{2}(a). The increase in IPR
345: computed from the time delayed matrix $D\left(\tau\right)$ indicate
346: correlations between system's behavior at a given time and its stroboscopic
347: image after $\tau$, rather than correlations within the spectrum.
348: In addition, it provides reasonable way of tracking down the sources
349: of lead-lag behavior. Thus, the observed features make IPR a good
350: candidate for an indicator of the network congestion state. Note also
351: significant change in height of the central peak.
352:
353:
354: \subsection{Frequency domain analysis}
355:
356: %
357: \begin{figure*}[t]
358: \begin{center}\includegraphics{ICombinedLambda.eps}\end{center}
359:
360:
361: \caption{\label{3} Eigenvalues number (a) $2$, (b) $257$, and (c) $497$,
362: plotted with respect to time and their respective Fourier spectra
363: ((d) through (f)). }
364: \end{figure*}
365: %
366: \begin{figure*}
367: \begin{center}\includegraphics{ICombinedIPR.eps}\end{center}
368:
369:
370: \caption{\label{4} IPRs for eigenvalues number (a) $2$, (b) $257$, and
371: (c) $497$, plotted with respect to time and their respective Fourier
372: spectra ((d) through (f)). }
373: \end{figure*}
374:
375:
376: The next step in getting more quantitative on long memory processes
377: in network traffic is to analyze transient behavior of eigenvalues
378: and IPRs of matrix $D\left(\tau\right)$ in detail. Since quasiperiodic
379: behavior is present in the majority of quantities of interest we focus
380: on their frequency content. The standard way to proceed is to transform
381: $\lambda_{i}\left(\tau\right)$ into frequency domain using fast Fourier
382: transform. In a sense, we construct a spectra of the spectrum. The
383: same operation is performed on respective IPRs. We take fast Fourier
384: transforms for all of the functions at hand, and then, take the square
385: of their absolute value. The result is referred to as a power spectrum.
386: There should be no confusion, as graphs of power always accompany
387: the corresponding time domain quantity.
388:
389: In Fig. 3 we display representative eigenvalue dynamics. Once again,
390: random $\lambda_{i}$ (Fig. 3(b)) does not exhibit anything remarkable,
391: compared to its regular counterparts. The latter resemble each other,
392: reflecting a symmetry of the spectra induced by symmetrizing procedure
393: (Eq. (\ref{DeeOfTau})). For now, we can talk about them in parallel.
394:
395: Aside from a substantial low and high frequency contribution, which
396: could have already been guessed from Figs. 3(a) and (c), we discover
397: two strong contributions from frequencies corresponding to oscillations
398: with time periods $15$ and $30$ minutes respectively (cf. Figs.
399: 3(d) and (f)). This is in evident contrast to the situation with power
400: of a random eigenvalue. Such an eigenvalue has equal (negligibly small)
401: contribution from the entire range of frequencies. The existence of
402: these two characteristic frequencies suggests a natural way assessing
403: the current state of the inter-domain network traffic. In fact, it
404: might be possible to use these as the LRD quantifier estimators \cite{Faloutsos}
405: in the future.
406:
407:
408: \section{experiments with altering actual network traffic }
409:
410:
411: \subsection{Noise-like injections}
412:
413: Next, we investigated consequences of modifying the time-lagged correlations
414: between time series. We have already known the time series contributing
415: the most to the correlation pattern \cite{Rojkova}. All of them can
416: be linked to eigenvalues which fall in what we term here as the right
417: segment of eigenvalue spectrum. In these series we replaced the original
418: traffic counts with counts obtained by random number generator for
419: a certain period of time. Then, we constructed matrix $D\left(\tau\right)$
420: for all hundred increments and repeated manipulations described in
421: previous Section 3.1. The results are shown in Fig. \ref{1}(d) through
422: (f).
423:
424: The eigenvalues belonging to middle of the spectrum are completely
425: unaffected, i.e. they are still time delay invariant. Clearly, our
426: manipulations with the traffic are not disturbing the self-similar
427: nature of delayed correlations. However, edge eigenvalues loose time
428: scales present in their original transient behavior (see Fig. \ref{1}
429: (d) through (f)). In other words, the LRD gets destroyed. Effect on
430: the IPR (Figs. \ref{2}(d) and (f).) is less noticeable but is still
431: there, while for the random segment it is absent. The result of random
432: counts injections can be summarized as presence of randomly positioned
433: of small peaks superimposed on the original IPR picture. Indeed, in
434: Figs. \ref{2}(a) and (c) small peaks are very infrequent and unstable
435: in time, unlike these in Figs. \ref{2}(d) and (f). %
436: \begin{figure*}
437: \begin{center}\includegraphics{ICombinedLambdaExp1.eps}\end{center}
438:
439:
440: \caption{\label{5} Eigenvalues number (a) $2$, (b) $257$, and (c) $497$,
441: plotted with respect to time and their respective Fourier spectra
442: ((d) through (f)) after noise-like sample was injected.}
443: \end{figure*}
444: %
445: \begin{figure*}
446: \begin{center}\includegraphics{ICombinedIPRExp1.eps}\end{center}
447:
448:
449: \caption{\label{6} IPRs for eigenvalues number (a) $2$, (b) $257$, and
450: (c) $497$, plotted with respect to time and their respective Fourier
451: spectra ((d) through (f)) after noise-like sample was injected.}
452: \end{figure*}
453:
454:
455: The above outcome calls for a more close look into eigenvalues and
456: IPRs for the system experienced the noisy injections into the time
457: series, which are believed to have major contribution to the overall
458: traffic in router network. We present three eigenvalues considered
459: in Section 3.2 as the functions of time delay together with their
460: respected power spectra. As can be concluded from Fig. 5(a) and (c),
461: the time dependence looses its LRD structure. It is backed up by the
462: fact that a lot more frequencies contribute to power spectra upon
463: random injection. Middle part of the spectra also undergoes certain
464: transformation, but is still scale-free Fig. 5(b), as actual values
465: of power are small relative to the power corresponding to edge eigenvalues.
466: The quantitative changes are also in place for both edge eigenvalues.
467: The effect can be judged based on comparison of the tallest peaks
468: in Figs. 5(d) and (f) to their counterparts in Figs. 3(d) and (f).
469:
470: Similar conclusions can be derived for the IPR as we take a look at
471: Fig. 6(d) and (f) and compare the outcome of our experiment with the
472: graphs in Fig. 4(d) and (f).
473:
474:
475: \subsection{Periodic in time injections}
476:
477: %
478: \begin{figure*}
479: \begin{center}\includegraphics{LambdaExp2.eps}\end{center}
480:
481:
482: \caption{\label{7} Eigenvalues number $2$, $257$, and $497$: The results
483: of the injections with $2.5\, min$ period.}
484: \end{figure*}
485: %
486: \begin{figure*}
487: \begin{center}\includegraphics{LambdaExp5.eps}\end{center}
488:
489:
490: \caption{\label{8} Eigenvalues number $2$, $257$, and $497$: The results
491: of the injections with $15\, min$ period.}
492: \end{figure*}
493: A logical continuation of the above experiment is the injection of
494: an artificial traffic counts which possess regularity into actual
495: experimental data. This time, however, we perform the replacements
496: for the time series which can be traced back to the eigenvalues falling
497: into the random segment. Time series for this replacement were chosen
498: at random. Other possibilities can also be considered, but since random
499: segment was much less susceptible to the previous experiment, the
500: above choice seems natural.%
501: \begin{figure*}
502: \begin{center}\includegraphics{LambdaExp6.eps}\end{center}
503:
504:
505: \caption{\label{9} Eigenvalues number $2$, $257$, and $497$: The results
506: of the injections with $20\, min$ period.}
507: \end{figure*}
508: %
509: \begin{figure*}
510: \begin{center}\includegraphics{LambdaExp7.eps}\end{center}
511:
512:
513: \caption{\label{10} Eigenvalues number $2$, $257$, and $497$: The results
514: of the injections with $30\, min$ period.}
515: \end{figure*}
516:
517:
518: We choose four injections to be cosinusoidal, having periods of $2.5$;
519: $15$; $20$ and $30\, min$ and repeating the same manipulations
520: as in the first experiment discussed in Section 4.1. The results are
521: fairly sound. Although the random part of the eigenvalue spectrum
522: is again unaltered, the {}``reaction'' of left and right parts is
523: both qualitative and quantitative. When cosinusoidal sample with period
524: much smaller than both characteristic periods ($15$ and $30\, min$),
525: power spectra in Figs. 7(d) and (f) are not significantly changed.
526: Two characteristic periods are still present, and yet certain narrow
527: frequency range gets suppressed (note anti-peak between the main two).
528: Notice slight asymmetry in the way smallest and largest eigenvalues
529: react to the injection. We should add, that we observed essentially
530: the same picture for the injections with period of $5$ and $10$
531: minutes (both not matching, but commensurate with characteristic periods).
532:
533: Now, we turn to Fig. 8, where the cosinusoidal replacement with period
534: $15\, min$ of actual traffic counts leads to the dramatic change
535: in power spectrum. We observe enhancement of the peak corresponding
536: to period of $15\, min$, which can be termed as resonance phenomenon
537: (Figs. 8(d) and (f)). The very same plots show the suppression of
538: peaks corresponding to the other characteristic period of $30\, min$.
539: Similar resonant effect is achieved when the period of injection is
540: changed to $20\, min$ (see Fig. 9). This time, both peaks are gone,
541: while the new characteristic period is detected in Fig. 9(f). It is
542: approximately equal to the period of injection. Finally, for the experiment,
543: in which period of the injection was chosen to be $30\, min$, i.e.
544: matching to another characteristic period, we obtained yet another
545: result supporting previous conclusions.
546:
547: In this case, however, the resonance phenomenon is slightly more difficult
548: to establish. From the results displayed in Fig. 10. We see, that
549: relative contribution to power spectrum is now changed for two main
550: peaks. Before the experiment was performed, the higher harmonic (smaller
551: period) dominated by quite a few orders of magnitude. After running
552: the experiment, this is still the case for the spectrum of largest
553: eigenvalue, but now the difference is marginal (see Fig. 10(d)). At
554: the same time for the left most eigenvalue, we determined, that lower
555: harmonic (period, matching the period of injection) now contributes
556: the most, as can be checked in Fig. 10(d). Two power spectra for the
557: edge eigenvalues are no longer symmetric and the contributions from
558: some ranges of frequencies are again strongly diminished. As for the
559: random eigenvalue considered Fig. 10(b) and (e), no impact has been
560: recorded, just as in all other cases.
561:
562:
563: \section{Discussion}
564:
565: Long range or time dependent processes which show significant correlations
566: across large time scales were first discovered in network traffic
567: over a decade ago. Since then, LRD was found and studied intensively
568: in various aspects of network behavior. LRD is a manifestation of
569: self-similarity of the process, meaning that the behavior of the process
570: is space and time scale invariant. Leland and colleagues performed
571: first rigorous statistical analysis of self-similar characteristics
572: in Local Area Network (LAN) traffic \cite{Leland}. They showed that
573: the aggregated Ethernet traffic is not smoothing out with accordance
574: to Poisson model, it is time scale invariant. In this framework the
575: traditional Poisson or memory-less models of network traffic became
576: inadequate. Since high variability across different time scales produces
577: high congestion level, the impact of the self-similar traffic models
578: on queuing performance is considerable \cite{Erramilli}.
579:
580: However, the identification of self-similarity origin and estimation
581: of LRD in network traffic are far from straightforward. One of the
582: effective procedures to quantify LRD is to calculate the value of
583: Hurst parameter. Even though the Hurst parameter is a scalar it cannot
584: be calculated directly, it can be only estimated. There are several
585: methods to estimate the Hurst parameter and sometimes they produce
586: the conflicting results. Ineptly, it is not clear which method provides
587: the most accurate estimation \cite{Molnar,Krunz}.
588:
589: In this paper, we proposed the LRD and self-similarity indicators
590: of delayed correlations in network traffic. We demonstrated, that
591: the time delay invariant behavior of non-edge eigenvalues of $D\left(\tau\right)$
592: reflects the self-similar nature of delayed correlations. Meanwhile,
593: the scaling with time of edge eigenvalues or their lagged-time dependence
594: is an exhibition of self-similarity of delay correlations.
595:
596: In addition, we established that the IPR for eigenvectors of lagged
597: correlations are concise parameters of realistic model for network
598: congestion pattern. As was shown in \cite{Rojkova}, IPR for $D\left(0\right)$
599: contains two localization trends in network interactions, i.e. two
600: regions in spectrum, traced back to a small number of time series,
601: which create the bottleneck at the routers. It is noteworthy, that
602: the IPR for $D\left(\tau\right),$ where $\tau>0$, reveals the third
603: localization trend, which has different origin. The significantly
604: increased and time delay invariant IPR around the median eigenvalue
605: indicates presence of lead-lag relationship between time series.
606:
607: With experiments altering the original traffic time series several
608: distinctive effects has been uncovered. First of all, we demonstrated
609: that tempering with time series has no effect on self-similar transient
610: behavior of eigenvalues and IPRs, located in the middle segment of
611: the spectrum. By contrast, both stochastic and periodic injections
612: into the right (non-random) and middle (random) segments respectively
613: yielded dramatic changes in chosen indicators. In particular, we recorded
614: the destructive effect of random noise on otherwise simplistic double-peaked
615: power spectra.
616:
617: One of the main results we obtained from periodic injection experiments
618: was presence of resonance phenomenon. When the period of injection
619: coincides with one of the characteristic time scales of the network
620: (i.e. oscillation periods of edge eigenvalues) the corresponding spectral
621: peak gets enhanced. The Fourier transform peak, corresponding to the
622: other scale gets suppressed and sometimes even annihilated. Finally,
623: injection with the period much less than both scales has little effect
624: on Fourier spectra, while period of the same order in magnitude rearranges
625: the original spectra completely.
626:
627: The above described time-lagged correlational analysis has a broad
628: area of applications, where delayed correlations between system substructures
629: are essential. For instance, it can be applied to electro-physiological
630: time series of brain response \cite{Kwapien}, earthquake relocations
631: \cite{earthquake}, financial portfolios \cite{GlupyeIndusy,Biely},
632: and atmospheric data \cite{GlupyeIndusy}. To support this assertion
633: we point out that edge eigenvalues of $D\left(\tau\right)$ behave
634: almost identically to these of atmospheric data, while the delay eigenvalues
635: of the stock market data act just like the eigenvalues, we termed
636: random \cite{GlupyeIndusy}.
637:
638:
639: \section*{acknowledgment}
640:
641: This research was partially supported by a grant from the US Department
642: of Treasury through a subcontract from the University of Kentucky.
643:
644: \begin{thebibliography}{10}
645: \bibitem{Rojkova}V. Rojkova and M. Kantardzic, Analysis of inter-domain traffic correlations:
646: random ratrix rheory approach, arXiv.org:cs/0706.2520 (2007-06-21).
647: \bibitem{Barthelemy}M. Barthelemy, B. Gondran and E. Guichard, Large scale cross-correlations
648: in internet traffic, arXiv:cond0mat/0206185 vol \textbf{2} 3 Dec 2002.
649: \bibitem{GlupyeIndusy}K.B.K. Mayya and R.E. Amritkar, Analysis of delay correlation matrices,
650: oai:arXiv.org:cond-mat/0601279 (2006-12-20).
651: \bibitem{Guhr3}T. Guhr, A. Muller-Groeling, and H.A. Weidenmuller, Random matrix
652: theories in quantum physics: common concepts, Phys. Rep. \textbf{299},
653: 190 (1998).
654: \bibitem{Burda}Z. Burda, A. Jarosz, J. Jurkiewicz, M.A. Nowak, G. Papp, I. Zahed,
655: Applying free random variables to random matrix analysis of financial
656: data, cond-mat/0603024 (2006).
657: \bibitem{Biely}C. Biely and S. Thurner, Random matrix ensemble of time-lagged correlation
658: matrices: derivation of eigenvalue spectra and analysis of financial
659: time-series, arXiv:physics/0609053 vol \textbf{1} 7 Sep 2006.
660: \bibitem{Lo}A.W. Lo and A.C MacKinlay, When are contrarian profits due to stock
661: market over-reaction?, Review of Financial Studies, \textbf{3}, 175-206
662: (1990).
663: \bibitem{Chordia}T. Chordia and B. Swaminathan, Trading volume and cross-autocorrelations
664: in stock returns, Journal of Finance, \textbf{55}, 913-936 (2000).
665: \bibitem{Erramilli}A. Erramilli, O. Narayan, and W. Willinger, Experimental queuing analysis
666: with long-range dependent packet traffic, IEEE/ACM Trans. Networking,
667: vol \textbf{4}, 2, 1996, 209-223.
668: \bibitem{Krunz}M. Krunz, On the limitations of the variance-time test for inference
669: of long-range dependence, IEEE INFOCOM, 2001, 1254-1260.
670: \bibitem{Molnar}S. Molnar and T.D. Dang, Pitfalls in long range dependence testing
671: and estimation. GLOBECOM, 2000.
672: \bibitem{Faloutsos}T. Karagiannis, M. Molle, and M. Faloutsos, Long-range dependence,
673: ten years of Internet traffic modeling, IEEE Internet Computing, Oct
674: 2004.
675: \bibitem{Kwapien}J. Kwapien, S. Drozdz, and A.A. Ioannides, Temporal correlations versus
676: noise in the correlation matrix formalism: an example of the brain
677: auditory response, arXiv:cond-mat/0002175, vol \textbf{1}, 11 Feb
678: 2000.
679: \bibitem{earthquake}W.-X. Du, C. H. Thurber, and D. Eberhart-Phillips, Earthquake relocation
680: using cross-correlation time delay estimates verified with the bispectrum
681: method, Bulletin of the Seismological Society of America, June 2004,
682: vol \textbf{94}, 3, 856-866.
683: \bibitem{Leland}W.E. Leland et al., On the self-similar nature of Ethernet traffic,
684: IEEE/ACM Trans. Networking, vol \textbf{2}, 1, 1994, 1-15.
685: \end{thebibliography}
686:
687: \end{document}
688: