Top Banner
Centrum voor Wiskunde en Informatica PNA Probability, Networks and Algorithms Probability, Networks and Algorithms Load characterization and anomaly detection for voice over IP traffic M.R.H. Mandjes, I. Saniee, A.L. Stolyar REPORT PNA-E0512 OCTOBER 2005
30

Load chracterization and anomaly detection for voice over IP traffic

Mar 28, 2023

Download

Documents

Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Load chracterization and anomaly detection for voice over IP traffic

C e n t r u m v o o r W i s k u n d e e n I n f o r m a t i c a

PNAProbability, Networks and Algorithms

Probability, Networks and Algorithms

Load characterization and anomaly detection for voice over IP traffic

M.R.H. Mandjes, I. Saniee, A.L. Stolyar

REPORT PNA-E0512 OCTOBER 2005

Page 2: Load chracterization and anomaly detection for voice over IP traffic

CWI is the National Research Institute for Mathematics and Computer Science. It is sponsored by the Netherlands Organization for Scientific Research (NWO).CWI is a founding member of ERCIM, the European Research Consortium for Informatics and Mathematics.

CWI's research has a theme-oriented structure and is grouped into four clusters. Listed below are the names of the clusters and in parentheses their acronyms.

Probability, Networks and Algorithms (PNA)

Software Engineering (SEN)

Modelling, Analysis and Simulation (MAS)

Information Systems (INS)

Copyright © 2005, Stichting Centrum voor Wiskunde en InformaticaP.O. Box 94079, 1090 GB Amsterdam (NL)Kruislaan 413, 1098 SJ Amsterdam (NL)Telephone +31 20 592 9333Telefax +31 20 592 4199

ISSN 1386-3711

Page 3: Load chracterization and anomaly detection for voice over IP traffic

Load characterization and anomaly detection forvoice over IP traffic

ABSTRACTWe consider the problem of traffic anomaly detection in IP networks. Traffic anomalies typicallyarise when there is focused overload or when a network element fails and it is desired to inferthese purely from the measured traffic. We derive new general formulae for the variance of thecumulative traffic over a fixed time interval and show how the derived analytical expressionsimplifies for the case of voice over IP traffic, the focus of this paper. To detect load anomalies,we show it is sufficient to consider cumulative traffic over relatively long intervals such as 5minutes. We also propose simple anomaly detection tests including detection of over/underload.This approach substantially extends the current practice in IP network management where onlythe first order statistics and fixed thresholds are used to identify abnormal behavior. Weconclude with the application of the scheme to field data from an operational network.

2000 Mathematics Subject Classification: 60K25Keywords and Phrases: traffic measurements, anomalies, Voice over IPNote: This paper was published in IEEE Transactions on Neural Networks, 2005

Page 4: Load chracterization and anomaly detection for voice over IP traffic
Page 5: Load chracterization and anomaly detection for voice over IP traffic

������� ����� ����������������������� ����� !�"��# ��$&% '(�����)���*�+��� ,-���/.0�1�+�)��32����5476 89� ��: �

;9<>=@?BADC�;FEHG*IKJLADMNOEP=DQ*CSRLTVUHW�;XEKRY?BADZ[EKRY<>=DEHC]\^=D<_A`G*=aA`M

b�G*<ScdADefMg<_RhT[UHWjilkmADG�RfAnporqsout1U`vXwBxzy

y|{P}|}�~�����G*Mg=@?BA`IBAi�?BA��"AaRY?BADefC�EPG*I*M

Z�<>=@?BADC�o�Z[EHG*IKJLADM@��=�k"<�o�G*C

�+eYEKJ�\�EPG*<�A�A|�*~�C_Aav*EHG*IBA�e���o]\�RYU|CST EPe;FE7R-?BADZ[EKRY<�=`EHC)\^=D<_A`G*=aADM

t1ADC>C���EK�]UHeYEKRYUHef<�ADM�3Q*=aADG�R"i�AD=@?*G*U|C�UH�d<�ADM� }H}�;9U|Q*GdR@EP<>G�~"cdADG^QBA

;XQBegeYE`T���<>C�C��*����}�yP��y��P�h} �|�H�� <><�M���M RYU|C_T EKe�¡H��egADMgA`EPef=@?¢o£�uADC>CS�+C>EP��M�o£=DUHZ

;FE`TXw^��wP}|}d{

¤�¥P¦+§©¨hª�«¬§­�®B¯�°g±a²´³£µ�®�¶P·´¸�®�¹a¶º°¬»�¼½®+¾�°¬¿@·À¶ºÁLÂ�¯^Á¬±�°g¾�Á¬¼½Ã)µ�®�·À®+¯�·´³½°g±�³£±¢Ä�Åm±a®�·_Æ�°¬¶´Ç-²+ÈHÉP¶ºÁLÂ�¯^Á¬±�°g¾jÁLÊ

¼£³½®+²�·_Ã-¹�³£¯�Á¬¼�¼½Ã�Á ¶º³£²´®�ÆO¸a®+±�·´¸a®�¶´®)³£²B¿�°@¯�Ëa²À®+µ�°h̬®�¶º¼½°gÁ¬µ1°¬¶*ÆO¸a®+±�Áp±a®�·_Æ�°¬¶´Ç�®+¼£®+¾p®+±f·B¿rÁ¬³£¼£²BÁ¬±aµ³½·3³�²3µ�®+²º³½¶´®+µÍ·À°�³£±a¿�®�¶3·´¸�®+²À®�¹�Ë�¶´®+¼½Ã�¿Î¶´°g¾Ï·´¸�®�¾j®+Á¬²´Ë�¶´®+µ�·À¶ºÁLÂ�¯ È�­�®1µ�®�¶º³½Ì¬®�±�®�ÆÑЬ®+±�®�¶ºÁ¬¼¿�°¬¶Ò¾3Ëa¼�Á ®)¿�°¬¶�·´¸�®)ÌLÁ ¶Ò³£Á¬±a¯�®¢°¬¿|·´¸�®�¯�Ë�¾3Ëa¼�Á ·´³½Ì¬®)·À¶ºÁLÂ�¯)°h̬®�¶uÁpÓaÔ-®+µ�·´³£¾p®¢³£±Y·À®�¶´Ì Á¬¼7Á¬±aµ�²´¸a°©Æ¸�°©Æ9·´¸�®�µ�®�¶º³£Ì¬®+µ�Á¬±�Á¬¼½ÃY·´³�¯�Á¬¼ ®�Ô@¹a¶´®+²´²º³½°g±�²º³£¾p¹�¼£³½Ó�®+²)¿Î°¬¶�·´¸a®�¯�Á¬²À®1°¬¿O̬°g³£¯�®�°©Ì¬®�¶pÄ�Å�·À¶ºÁLÂ�¯ Õ·´¸�®�¿�°@¯�Ëa²�°¬¿ ·´¸a³£²O¹�Á ¹z®�¶+È]ÉK°�µ�®�·À®+¯�·¢¼½°gÁ¬µlÁ¬±�°g¾jÁ¬¼£³£®+²�ÕDÆ�®p²´¸�°hÆ�³£·�³£²u²´Ë@Â�¯�³£®+±f·�·À°�¯�°g±�²´³£µ�®�¶¯�Ëa¾�Ëa¼£Á ·´³½Ì¬®�·À¶ºÁLÂ�¯�°h̬®�¶j¶´®+¼£Á ·´³½Ì¬®+¼£Ã�¼½°g±�Ð�³£±Y·À®�¶´Ì Á¬¼£²�²´Ëa¯º¸ÖÁ¬²j×l¾j³�±YË�·À®+²+ÈÍ­�®�Á¬¼£²À°�¹a¶´°¬¹z°g²À®²´³£¾p¹D¼½®�Á¬±�°g¾jÁ¬¼£Ã�µ�®�·À®+¯�·´³½°g±l·À®+²À·´²)³£±a¯�¼�Ëaµa³£±�Ðpµ�®�·À®+¯�·´³£°g±m°¬¿ °©Ì¬®�¶&ØLËa±�µ�®�¶º¼½°gÁ¬µ�È]É�¸a³�²OÁ ¹a¹a¶º°gÁ¬¯º¸²´Ë�»�²´·´Á¬±f·´³£Á¬¼�¼½Ã�®�Ô-·À®+±aµ�²�·´¸a®�¯�Ë�¶º¶´®+±f·u¹a¶ºÁ¬¯�·´³�¯�®�³£±mÄ�Å�±�®�·_Æ�°¬¶´Çm¾�Á¬±aÁ Ð¬®+¾p®+±Y·uÆ�¸�®�¶´®�°g±a¼½Ã1·´¸�®Ó�¶º²À·�°¬¶ºµ�®�¶]²À·´Á ·´³£²À·´³�¯�²uÁ¬±�µ�Ó�Ô-®+µm·´¸�¶´®+²´¸a°g¼£µa²OÁ ¶º®�Ëa²´®+µm·À°�³£µ�®+±Y·´³½¿ÎÃ�Á »�±�°¬¶º¾�Á¬¼7»z®+¸aÁ+Ì@³½°¬¶+Èu­�®¯�°g±a¯�¼£Ëaµa®�ÆO³½·´¸�·´¸�®uÁ ¹�¹�¼£³£¯�Á ·´³½°g±j°¬¿7·´¸�®�²º¯º¸�®+¾p®u·À°3Ó�®+¼£µ�µ�Á ·´Á�¿Î¶´°g¾�Á¬±�°¬¹z®�¶ºÁ ·´³½°g±�Á¬¼�±�®�·�Æ^°¬¶´Ç`ÈǬ®�Ã�Æ^°¬¶ºµ�²�Ù

Ú

Page 6: Load chracterization and anomaly detection for voice over IP traffic

� ��������� � ���������

�������������! #"%$'&)(* + #,.-/��0213�!-4&5�6�7 7(98:&�(3 #�:;<��03-4����-/��0=�7�2��>��� #0!�@?�A��@�7���7B���&��3$#�C�58�&�-/����&�,D�3E����

F�G (*�+EH�! #>:$I(3��?J�7BK��-4 I��L.�7�5��$+-/;�- G -/��,M�7�N�3�+B��� �( FKF�G -/&)(*�+-4�!��$I(3��?O>���?�-4(KPRQS�T����1!�� 5UV;<�5EH�! #�W�7B�-/$�7 +(3��$#-/�7-/�!�X;Y�5&��!>���$Z��-4?K��$ F +�)(*?[U�"3��, F +�!; G ��>�$Z-4�D���5���\�! #"]>:(3�^(303��>����_�`(3��?D� F �5 7(*�+-4�!�D���5��?�7� ;<��(3?K?� +�5$+$+�5?[Pa���N�+B�-4$ F ( F �5 '�\�=EH�b&5A�$6�!� G �!(3?c&dB^(3 +(3&5�+�� #-4e)(9�7-4�3�[U��T1!�5 G �!(3?f?��5�+��&5�+-4�!�f(*��?>��! +��0!�5���� +( G4G ,=g4h�i_j6i3klh9m�i3gon'j.p�q�pdr�qtsuh9k'-/��$#��0!>����_�+$��3El���a���5���\�! #".$\�7B^(*�v&�(3 + w,yxz( G >:�!$w�|{}�|Lb& G A.~$+-�1!� G ,�1!�!-/&��C�7 7(98:&*Ul�*P�0�P�U[(*�W��0! #��$#$ F �3 #���3Ev(3�����O +�3AK�7�5 ��! S$#��-��7&dB &��3������&��7�5?W�7�I�+B��`�+ +A���"%-/��01!�3-4&��`0_(*�+�5��(T,3P���$�-����+A� +��$��!AK��UY>:(3�_,2�3�7B��5 �$#��0!>����_�+$V�3E�(3�y���J-4�KEH +(3$#�+ +A�&��7A� #�'&)(* + #,.-/��0 G (3 +0!�(3>��!A��_�7$��3E1!�3-4&��`�7 7(98:&`>I(),y;Y�`?���?K-4&)(9�7��?W�+�=&)(* + #,y>��!$#� G ,�1!�3-4&��`�7 7(98:&*PV��B�-/$���>��� #0!��$�EH +�!>�7BK�`(* +&dB�-��7��&��7A� #��$S�3E}>I(3�_,I����~�;^(3$#��?��K�5���\�! +"%$�&�(3 + w,.-4��061!�3-4&��*U�(3$�$+BK�����y-4�2��-/0!A� +� Ú P

��B��`�����5?yEH�! �?����7��&��7-/�!���3E G �_(*?�(3�K�!>I( G -4�5$�(3 #-4$+�5$�U^EH�! ���LK(3> F�G �3U^��B����W(3��(9��, F -4&)( G�G �_(3?�&dB^(3�K0!�xt-/��&� #�)(3$#���3 v?K��&� #�)(3$#�T{\-/$���L F �5 +-/����&5��?=;_,:( F �! w�7-4�3���*E[�7B��S���������! #"�P���`�)hTr��_�Tp+jIh9�3p��|g4h�i_jS( G (3 +0!��%A�>�;<�� ��*EY&�( G4G �� #$}�7 w,`�+�� +��(3&dB6�7B���$+(3>:�\?���$w�7-/�^(*�7-/�!� F BK�!�����%A�>�;<�� )xt$d{�(*��?��7B����K�5���\�! +"'(3?�>�-/�7$�7�.�@>I(*�%,I&)( G/G $5Pv�y�! +�Z0!�5���� +( G4G ,!U��T13�� G �_(3?��! �-4�K?����5?]�.k<j.p��|g4h�i_j��.&�&5A� +$���B��5�W(6$+�50!>:�5�_���*E��7BK����������! #"CEt(*- G $�(*��?`�+B��v�+ 7(*8�&\��-/�+B��� ��T1!�5 #�^�T��$-/�%�+��(S���! #>I( G $#��0!>����_�}�3E��+B��\�K�5���\�! +"C�! �>:-/0! 7(9�7��$()��(),XEH +�3>�-/�)PI���N(3�_,D�!�����3E��7BK��$+�:$+&5���^(3 #-4�!$5U�-/�C-/$C?K��$+-/ 7(3; G �@�7�Nj.p�q�pdr�q�7B����!��03�!-4��02�T1!�5 G �!(3?�! SA���?��5 G �_(3? (3$SEt(3$#��(3$ F �!$#$+-/; G �*U<�+B.AK$�B�� G4F -/��0:�+B��'���������3 +"2� F �5 7(*�+�! ��7�I�7(3"3�` +��>���?K-�( G (3&��7-4�3��! V�+�2-/�_1!�!"*� F #�!0! +(3>:>���? #��$ F �!�K$+�3P���B�-/$�0!�_( G B�(3$�U�A��KEH�! w�7A���(*�7� G ,!U[�+A� +�K��?D�!AK�Z�7��;<��� G A�$#-/13�EH�! ��7BK�C�����K�5���\�! +"%$�EH�! �(61*(3 +-/�5��,��3E} +��(3$+�3��$V(3�K?2��, F -/&)( G/G ,I�+B��C���5���\�! +"�� F �� +(*�7�3 �B��)(3 #$�(*;Y�!Ab�

F �� #EH�3 +>:(3��&�� F #�!; G ��>�$VEH +�!>�&5A�$#�+�!>��� +$Z;<�5EH�! #�6�7B���x G (3 +0!��(3>:�3A��_�7$Z�3E7{�-/�KEH�! #>I(*�+-4�!��()13(*- G (*; G ��7��-��VB^(3$Z;<���5�](*?����%A^(*�+� G ,X(3�^( G ,.e���?lP'�a�6$#B��T�R�+B^(*�C(*� G �)(3$w�Z-4�W�+B������!����$#��0!>����_�+$C�*E�(3� ������������! #"�U��+B�-4$����5��?2���3�S;<�V�7B��Z&)(*$+�3P

���:(3�I����~�;�(3$+�5?I���������! #"�Ub�7BK���+ 7(*8�&S-4�KEH�3 +>:(*�7-/�!�6()1*(3- G (3; G �\-4$�7BK�S&5A�>�A G (*�7-�1!�S(3>��!A��_�7$��3EY�7 +(*8�&x� w;%,%�+�\&5�!A��_�7$#¡%{��T13�� �¢�>�-4�%AK�+���7-4>��-4�_�+�� #1*( G $vxH�+B���s �#£�k�¤�r�q�p�qH�[(3��?�s �9¤��bq#¤�r�q�p�qH�}�2��¥�$}-/�`¦K§V���v{|P�^�! �?�(*�d(��+ 7(*8�&�¨�13��>:-/�.Ab�7��$�-4$�-/��?����5?@( G �!�K0��7-/>:�*P�©�(3�@$#A�&dBc w&� +AK?���¡�-/�KEH�! +>:(*�+-4�!�`(3$v¢�>�-4�%AK�7�

ª

Page 7: Load chracterization and anomaly detection for voice over IP traffic

;_,%�7��&5�!A��_�7$�;Y�`�58�&�-/���_� G ,yAK$+��?WEH�3 G �_(3?y(3���!>:( G ,=?��5�+��&5�+-4�!���c�]�'$#B��T� -4�2�7B�-/$ F ( F �5 ��7B�(*��EH�3 �7BK�`���!�����7 +(*8�&C�+B���(*��$#�\�� V-/$= �,!��$#¡�UlAK��?��� �(:>�- G ?y$#�5�V�*E�(3$+$#A�> F �7-/�!��$S�!�y�+B��'&5�b?�-/��0I +(*�7�!xt$7{�3E��7B�� F (*&d"3�5�+-4e5��?y13�!-4&5���7 7(98:&C(3�K?2�+B��Z>:��(3��&)( G/G ?�A� +(*�7-/�!�[P

� A� �( FKF +�_(*&dBD-/$�;^(*$+��? �+B��@(3�^( G ,.$+-4$��3E��7B���1*(3 #-�(3�K&��'�*Ev�+B��6;_,%�7�6&��3A��_�7$�xt-zP��*P/U� #$+�5&��!��?X�! #?��� #¡$#�7(*�7-/$#�+-4&�$5P {�� �5���6x���� ���|{�?��5���3�7�`�7B��6&5A�>�A G (*�7-�1!��(*>:�!AK�%���3E��7 +(*8�&�$+�5�%�Z�3�X( G -/��"�-4���+B��'�7-/>:�-4�_�+�� #1*( G x���� ����{�P���L F +�5$+$+-/�!��$�EH�! \�7B��V>��)(*��(3��?=1*(3 +-4(3��&5���3E��6x��������|{\&�(3��;<�V?��� #-/13��?�EH�! �(`13�� w,0!�5���� +( G >��b?�� G �3E����f�7 7(98:&*UK��-/�+B�?^(*�d(�$#��$#$+-4�3��$S(3 + #-/1.-4��0'(3$�(@�}�!-/$+$#�!� F +�.&��5$+$�P�x �a��?����+B^(*��-/�¦b�5&5�7-/�!���KP Ú {�PZ��� �7BK��$ F ��&5-�( G &)(3$#�6�3E\( G -4�K"���-��7BW���!����~��!� G ,2�7 +(*8�&3Ul��BK-4&dBX-4$S�7B���EH�.&�A�$��*E�7B�-/$F ( F �� 5Ub�+B���>:��(3��(3�K?=13(* +-�(*��&����3E��6x���������{vB^()13�V1!�� w,�$+-/> FKG �S& G �3$+��?=EH�3 +> ��L F #��$+$#-4�!�K$�U��7B�(*��(3 #�?��5$+&� #-4;<��?y-4���7B��'¦b��&��7-/�!���bP ª P\��$�-/���7AK +��$S�!AK��U<$#-4> F�G �V�+��$w�7$�;�(3$+�5?��!�2�7B��5$+�ZEH�! +>�A G (3�Z( G/G �T��A�$�7�@?�-/$+&5 +-4>�-4��(*�7�V;<�5���\���5�y���!��� (3��?2���!�b~u���!���M�+ 7(*8�&3U�(*��?y?K�5�7�5&5��(3���!>:( G -4��$\-4���7BK�ZEH�3 +>��� �P

��B��5 +�'-/$S(� #� G (9�7-/13� G , G (* +0!� G -/�7�5 7(*�+A� +���3�W(3���3>I( G ,I?K�5�7�5&5�+-4�!�y-4�2&��!>�>�A���-/&)(*�+-4�!���K�5���\�! +"%$�P��^�! (Z +��&5���_��$#A�>�>I(3 w,!U%$+�5��� Ú�� P�^�! �A�$+���3E[$+(3> F�G ��1*(3 #-�(3��&5��-4��&��!���#AK��&5�+-4�!�@��-/�+B��y��¥f13(* +-�(*; G �5$�U_$+�5�� Ú�ª�� P�^�! ��3�+B��� v( F�F +�_(3&dBK��$�U.�3P 0�P�U.¥�(),!��$#-�(3��;<� G -/�5EY���5���\�! #".$v-4�@&5�!���#A���&��7-/�!����-��7B:�y��¥N1*(3 +-4(3; G �5$�U$+�5� � ª�� P � A� �( F�F +�_(3&dBy?�-"!Y�� #$SEH #�!> �7BK��$+��( F�F #�_(3&dB��5$�?�A��C�7���7B��C?��� #-/1*(*�+-4�!�y(3��?213( G -4?�(*�7-/�!���3E(3�^( G ,%�7-/&)( G EH�! +>�A G (3��EH�3 ��7B��Z?����7��&��7-/�!� F (3 7(3>��5�+�� Cx 13(* +-�(*��&��){�P

���2$+A�>�>I(* #,!Ub�7B��Z&��3�%�+ +-/;�AK�7-/�!���3E��7B�� F ( F �5 S-/$��7B���EH� G/G �T��-4�K0$#

% �]��(3 +03A����7B�(*�$+�5&��!�K?:�! #?��� �$#�d(9�7-4$w�7-/&�$(3 #��A�$+��EHA G -/���7 7(98:&�(3���!>:( G ,C?����7�5&5�7-/�!��(3��?6�!;b�d(3-/��|L F +��$#$+-/�!��$�EH�! ��7B���1*(3 #-�(3��&5���3E�(�;_,%�7�Z&��3A��_��EH�! �(6�%A�-��7�Z0!���K�� 7( G ��� �7 +(*8�&C>��.?�� G P

% �]��$#B��T�J�7B^(9�)U.-4�@�7B��S&)(3$#���3EY���!���a�7 +(*8�&3U.;_,.�+��&5�!A��_�7$\��13�� \ +� G (*�7-�1!� G , G �!��0C-4�_�7�5 #1*( G $�&�(3�-/��?����5?y;<�ZA�$+�5?2EH�3 �(3���!>:( G ,:?����7��&��7-/�!�[P

% �]�Z?��513� G � F (6$+�����*E�?����7�5&5�7-/�!� F +�.&��5?�A� #��$�U�EH�! �?�-&!l�5 +�5�%����, F ��$S�3E�(3���!>:( G -/��$5P

% �]�C(3$+$#��$+$��7BK�C��8�&)(3&�,y�*E}�+B�� F +�.&��5?�A� +�5$S��-��7B� +��( G �7 +(*8�&V�7 +(3&��5$�P

��B�� F ( F �� �-/$��! +0!(3��-4e5��?X(3$VEH� G4G �T��$5P'���]¦b��&��7-/�!� ª �\�@;� +-/�5��,�?�-4$#&�A�$#$C(3��?X&��!�_�+ 7(3$w�`;_,%�7�@&5�!A��_�

Page 8: Load chracterization and anomaly detection for voice over IP traffic

��-/0!A� +� Ú # É^ÃY¹D³£¯�Á¬¼KÁ ¶º¯Ò¸a³½·À®+¯�·´Ë�¶º®3°¬¿�Á¬±�Ä>Ås±�®�·�Æ^°¬¶´Ç�·´¸aÁ ·�¯�Á ¶´¶Ò³½®+²OÁ�²´³½Ðg±a³½ÓD¯�Á¬±f·�Á¬¾j°gËa±f·u°¬¿��d°¬Ä�Å�·À¶ÒÁLÂ�¯ ÕÆO³½·´¸��d°¬Ä�ÅdÊS°g±�¼½Ã1±�®�·_Æ�°¬¶´Ç1²À®�Ðg¾p®+±Y·´²O¸a³£Ðg¸a¼£³½Ðg¸Y·À®+µ�³£±1µaÁ¬²´¸�®+µ�¼£³£±�®

�7 +(3&��5$�EH�! ����!���](3��?@0!�5���� +( G ���D�+ 7(*8�&�EH #�!>R(*��� F �5 7(*�+-4�!�^( G ���������3 +"�P��B�-4$ F +�T1.-4?��5$>:�3�+-/1*(*�+-4�!�EH�! �¦b��&��7-4�3� �'-4�I��BK-4&dB=�\�V¨^ +$w��?��� #-/13��('EH�! +>'A G (�EH�! \�+B��V1*(3 +-4(3��&5���3E�;_,%�7��&5�!A��_��>��)(3$#A� +�5>:�5�%�+$EH�! �0!�5���� +( G ���a�7 +(*8�&3Ub(3��?@�7B��5� F #��$+�5�_����L F�G -4&5-/�EH�! #>�A G (*��EH�! ��7B������!���a�+ 7(*8�&���-/�+BI�}(3 +���7��(*��?��L F �!���5�%�+-�( G &)( G/G ?KA� 7(*�+-4�!��?�-4$w�7 +-/;�AK�+-4�!��$5PV���D¦b�5&5�7-/�!���=�\�6?�-4$#&�A�$#$�A�$+��EHA G �K��$+$��*E�7B���>��)(*$+A� #��?$7(*> F�G �6;_,.�+�@&��!A��_�Z1*(3 +-4(3��&5��EH�! �?��5�+��&��7-4�3�D�*E�(3�K�!>:� G �!A�$�;Y�5B^()1b-/�! �P6���a¦b�5&5�7-/�!�]¢I���@?��5$+&� #-4;<��7BK +��� F +-4�K&�- F ( G ��, F ��$Z�3Ev( G (3 #>:$��7B^(9��&)(3� ;<�60!�5���� +(*�7�5?W��-/�7BW�+B���&5� G4G ��&5�+��?W�+ 7(*8�&�?^(9�d(KUYA�$+-/��0;<�3�7BI�+B����+B����3 +�5�+-4&�( G (*��?=>��)(3$#A� +�5?=13(* +-�(*��&��5$�P����¦b�5&5�+-4�!���C����( F�F�G ,@�+B����+��&dB���-/�%A�� F +�5$+�5�%�+��?�7��?^(*�7(:&5� G4G ��&5�+��?�EH +�!> (3��� F �� +(*�7-/�!�^( G ���5���\�! +"�P���-/�^( G/G ,!UK-4��¦b��&��7-4�3���6��� F +�T1.-4?K�'(�$+A�>�>I(* #,�3E��7B��Z>��5�+B��b?K� G �!0*, F #� F �!$+�5?y-/���+B�-4$ F ( F �5 �P

� ��� �� ���� ��=�� �������� � � ��������`��5�:������������ �:�!

¥���EH�! +���\�@?���$#&� +-/;Y�@(=>��.?�� G EH�! ����!���O�7 7(98:&*U -/��-/$V-4�K$#�7 #A�&5�+-/13���7� G �.�!"2(*�V�+ 7(3&5��$Z�3E����!��� (*��?0!�5���� +( G ���N�7 +(*8�&�;<�3�7BI>:��(3$+A� #��?=-/�:�+B��V$7(*>:�S� F �� 7(9�7-4�3�^( G ����~�;^(3$#��?����������3 +"�Pv��-40!AK +��$ ª (3�K? �

Page 9: Load chracterization and anomaly detection for voice over IP traffic

$+BK��� �7B��C¢�~�>:-/�%AK�7�V;_,%�7�C&��3A��_�7$S�!��������?�-4$w�7-/��&5� F �! #�+$��3E�(@$#�� w1b-/&�� F +�T1.-4?K�� ����������! #"�&�� G/G �5&5�7�5?�T1!�5 ��!���C���5��"�P���B��`¨� +$#���7 +(3&��C-4$��d(3"*����EH #�!> ( F �! w�S�+B^(*��&)(3 # +-/��$����!�����7 7(98:&C�!� G ,!U�-4�K& G AK?�-4��0���a$#-40!�^( G -4�K0��7 +(*8�&�(3��? F �!$#$+-/; G ,`�3�7BK�� �>I(* +0!-/�^( G ���!�b~u���!��� G �_(3?[U%(3�K?@�+B���$+�5&��!��?@�7 +(3&���-/$��d(3"*���EH +�3> ( F �! w���7B^(9��&)(3 # +-4�5$�0!���K�� 7( G ��� �7 7(98:&�$#A�&dBW(*$��J�J� U^�S©����*����UY���7&*P

¥��3�+Bc?^(*�7(y$#�5�7$C���5 +�=�3;K�d(3-/����?D1.-�(y$w�d(3�K?^(3 +?N¦K§V��� �y��¥ (*0!���_�7$C��-/�+Bf¢�~�>�-4�%AK�+��(30!0! #��0_(*�+-4�!�&�� G4G �5&5�+��?@�T1!�� \( F �5 +-/�b?@�3EY +�!AK0!B G ,'�!�����\����"�P � �����!AK�+$#�d(*��?�-4�K0ZEH��(*�7AK +���3E[;<�3�+B�?�(*�d(�$+���7$v-4$�7BK�?^(3- G ,� #��0!A G (3 #-/��,��3E}�7B�� G �_(*?2EH�! �;<�3�7By���O(3��?y���3���J(3$��3;�$+�5 #1!�5?[UlEH�! S��LK(3> F�G �3U�;_,y��BK�!>:$#�!�Mp�qi3g�� � Ú@Ú�� P� G $+��UK$+-4> F�G ��1.-4$+A�( G -4�K$ F ��&5�+-4�!���3E��7BK�V����� F +�*¨ G �5$S-/����-403A� +�5$ ª (*��? �@$#B��T��$S�+B^(*���7BK����!�����+ 7(*8�&@-4$�¡3$+>��b�3�+B��� #¡�(3��?DB^(3$ G �5$+$�1*(3 +-4(3;�- G -/��,��+B^(3�X�7B��@&5�! + #��$ F �!��?K-4��02�����7 +(*8�&6�7 7(*&��3P�]�W$+B��T� �7B^(9�I�7BK-4$=( F�F (3 #���_�� +�50!A G (* +-/��,f�*E��7B������3��� �+ 7(*8�&W&�(3�J;Y��>:�! #�yEH�! #>I( G4G ,c?��5¨^�K��?(3��?I��L F�G �3-/�7�5?:EH�! \?��5�+��&��7-4�3�=�3E A��K&dB^(3 7(*&5�7�5 +-/$#�7-/&6xt(3���!>:( G �3A�$d{ G �!(3?:1*(3 #-�(*�+-4�!�[P���� F (* #�7-/&�A G (3 �U_�\�$+BK��� �7B^(9�V�7B��6�3;�$+�5 #1!�5?D1*(3 #-�(3;K- G -���,�-4� �}-40!A� #� ª -4$�&��!> F�G ���7� G ,���-/�+B�-4�W�+B��6 7(3�K0!� F #��?�-/&5�7�5?X;%,�7BK� F +� F �!$+�5?2�+B����3 +�5�+-4&�( G >��b?�� G U.��B�- G �V�7B^(*�S�3E���-/0!A� +���@�|Lb&����5?�$V-��)P

� ���� � ����� ��� � � �'� �)�=� V��� ��� � ��� �� �!�� ��=�

�� �� � �����������������! �����"#"%$'&(�

¦bA FKF �!$#�:j_i3q�i@�Tpd�d��suh9kK��x ��B�-4&dB�-/� F (3 #�+-4&5A G (3 \>I(),:;Y�V13�!-4&5��&)( G/G $7{\(3 # +-/13��-4�=�+-4>��V(3&5&��! #?�-4��0��+�@(x F �!$#$+-4; G ,:���!�b~�B��!>��!0!���K���!A�$7{��}�3-4$+$#�!� F �3-4�_� F #�b&5��$+$��3���+B��V #�)( G (�LK-/$�)+*Rx-,!. �/.J{�P�xz¦b��� � Ú10 �EH�! ��+B�� F +�5&�-4$#�`?K�5¨^��-��7-/�!���3E(@���!-4$#$+�!� F �3-4�_� F +�.&��5$+$5P { �����32 ?K�����3�+���7B��@s k^q�p�kK��s qzn�mIp+i9���b�7p��3E�7BK-4$ F #�b&5��$#$�U%?��5¨�����?@�!�@¥��3 +� G $+A�;�$#�5�+$v�*E4)�P��a��(*$+$+AK>:���+B^(*��2]-4$�¨^�K-/�7���!�6;Y�3A���?��5?�$#�5�+$�P��B�-/$-4� F (3 #�+-4&�A G (3 \>:��(3��$��7B�(*���7BK��xt 7(*��?��!>I{\�%A�>�;<�� ��3E}(3 # +-�13( G $�x F �3-4�_�7$7{v��-/�+B�-4��(3�_,:¨^��-/�+�V-4�_�+�� #1*( Gx���� ��� � B�(3$����!-4$#$+�!��?K-4$#�+ +-/;�AK�7-/�!�Z��-/�7B`>:��(3�5236bx�������� �87 P�xH�OB��5�92a-/$�(3;K$+� G AK�7� G ,Z&��3�%�+-4�%A��!AK$}��-/�+B +�5$ F ��&��\�+� � �5;Y�5$+0!A���>��)(3$#A� +�*U_��-/�7B6�+B���&��!��$w�d(3�_�v?��5��$+-���,;:<*>=?2�@A= �|U!�+B����@�7BK-4$�(�B��!>��!0!�5�����!AK$

F #�b&5��$+$���-/�+B�-4�_�7�5��$+-���,B:�P {

¢

Page 10: Load chracterization and anomaly detection for voice over IP traffic

0

1e+08

2e+08

3e+08

4e+08

5e+08

6e+08

7e+08

8e+08

0 200 400 600 800 1000 1200 1400 1600 1800 2000

Inbo

und

VoIP

traf

fic m

easu

red

in by

tes

Time in units of 5-minutes

��-/0!A� +� ª # �d°g³�¯�®j°©Ì¬®�¶�Ä>Å ·À¶ºÁLÂ�¯�̬°g¼£Ë�¾p®j¾p®+Á¬²´Ë�¶º®+µÍ³£±Í×hÊ_¾j³£±-Ë�·À®j³£±Y·À®�¶´Ì Á¬¼£²)Á ·�Á¬±�®�Ь¶º®+²´²¢¹z°¬¶´·]°¬¿BÁ�É����� × ¾3»a¹�²���·À¶ÒËa±�Ç�°h̬®�¶uÁj¹`®�¶Ò³½°-µ�°¬¿H°g±�®¢Æ�®�®�ÇDÈ

0

5e+07

1e+08

1.5e+08

2e+08

2.5e+08

3e+08

3.5e+08

4e+08

4.5e+08

0 200 400 600 800 1000 1200 1400 1600 1800 2000

Inbo

und

IP tr

affic

mea

sure

d in

byte

s

Time in units of 5-minutes

��-/0!A� +� � #�� Á ·´ÁLÊS°g±a¼½Ã�Ä�Å ·À¶ÒÁLÂ�¯j̬°g¼£Ë�¾p®�¾p®+Á¬²´Ëa¶´®+µÍ³£±"×hÊ_¾�³£±YËa·À®�³£±Y·À®�¶´ÌLÁ¬¼�²¢Á ·3Á¬±"®�Ь¶´®+²´²3¹`°¬¶º·)°¬¿BÁmÉ����� × ¾3»a¹�²���·À¶ÒËa±�Ç�°h̬®�¶uÁj¹`®�¶Ò³½°-µ�°¬¿H°g±�®¢Æ�®�®�ÇDÈ

Page 11: Load chracterization and anomaly detection for voice over IP traffic

��$#$+A�>����+B^(*�I�+B��fxH 7(3��?K�!>={@(3>��!A��_�=�*EV�7 +(*8�&W0!���K�� 7(9�7��?J;_, (a$+�5$+$#-4�!�O(3 # +-�1!��?�(*�I�+-4>�� �@-/$?��5$+&� #-4;<��?2;_,2(@ +(3��?��3> ���!�b~�?���&5 +��(3$+-/��0:�K�!�b~��K��0_(*�+-/13�� +-403B%�w~�&5�!�_�7-4�%A��3A�$�EHA���&��7-4�3�

��� x��Y{������ 0 �

��B��5 +� ��� x��Y{ -4$��7BK��(3>��!A��_�}�3EK�+ 7(*8�&\0!�����5 7(*�+��?�-/�C�+B��v& G �3$+��?'-4�_�7�5 #1*( G � ������� � P�x � �5� ��� x 0 ,�{�* 0;_,'&5�!�_1!�5�%�+-4�!�lP {'�]��(3$#$+A�>����7B�(*���+B���?�-/$#�7 #-4;�Ab�7-4�3�'�3E ��� ?�� F ���K?�$�!� �}(3$�( F (3 +(3>:���7�5 �U_(3�K?'�7B^(9��7BK��EHA���&��7-4�3��$ ��� &��! # +�5$ F �!��?�-/��0'�7�'?�-"!Y�� #���_��$+�5$+$#-4�!��$�(* +��-/��?�� F �5��?����_�`xH�51!�5��-/E�(3 # +-�13( G �+-4>���$v�3E$+�3>:���3E}�7B��5> &��3-4��&5-4?��){�P

�� ������������^�! #>I( G/G ,3U��+B�� F #�b&5��$+$��\�@?���$#&� +-/;Y�5?X-4$�(Wm�i3���_p+j6�}�!-/$+$#�!� F �!-/�_� F #�b&5��$+$ � Ú10 � Ul��-/�+B�7BK�y +(3��?��!> EHAK��&5�+-4�!��$ � ;<��-4�K0]>:(3 +"%$��3E��+B�� F �!-/�_�7$�P ��B�-4$�>:��(3��$@�7B^(9���+B��2?�� F ����?K����&5�W�3E�7BK�`?�-/$#�+ +-4;KAK�7-/�!���3E ��� �!� ��>�A�$w��;<�Z$+A�&dBW�+B^(*���7BK�`>:(3 +"*��? F �!-/�_� F +�.&���$#$�&�(3��;<�C�\� G/G ?��5¨^�K��?(3$I(�xt>��)(*$+A� +(3; G �){� 7(3��?K�!> � G �5>:�5�_�)PO��B�-4$:&��!�K?�-/�+-4�!�M-4$@���3�I +�5$#�7 #-4&��7-/13�2EH�3 I(3�_,M&��3��&��5-/1*(3; G �( F�FKG -4&�(*�7-/�!�[P

� �5�SA�$�?��5���3�7��EH�! 0�� � � � ��� . U

� � "!� x�� ��#� �d{�$*&% � ��� x'� ��{ , ��� x�� ,�{ � �� � �(!� x�� ��#� ��{ $*)% � ��� x'� ��{ , ��� x�� ,�{ � � $

§��T�ZU G �5� ��x��������d{�?������*�7�V�7BK�V�7�3�7( G (3>��!A��_���*E��+ 7(*8�&V03�����5 7(*�+��?2;%,=( G4G $+�5$+$#-4�!��$�-/�=�7B���xH& G �3$+��?^{-4�_�+�� #1*( G � ������� � P

*+ -,.�/ ��0��1}h9��q'2^pCmIp+i3kWq�h9q�i3g�i3mIh9�.k^q\qt�#i43Jr65�p72Ki3�3p% �6x�� � ���|{�*98 �;:

<>= � � "!� x+x�� , �#{4? ������, �#{'2�x8= �#{ � x Ú {

5@2^p��7pA� ? $*�>I(�L 6B��� 0#7 ��

Page 12: Load chracterization and anomaly detection for voice over IP traffic

£H� % �6x��������|{ � . � q'2^p�k��(3 ��x��������|{�* 8 �;:

<>= � � �(!� x+x�� , �#{ ? ������, �#{-2�x = �#{ $ x ª {

�6�/, ,���� �. �� + PV¦.A F�F �!$+� ��� ����* Ú � ª � $ $ $ �<-4$�(I$+�5�%A�����&5�@�3E-uP -uP ?[P� 7(*��?��!> 1*(3 +-4(3; G ��$�U<(3�K?�� -/$ 7(*��?��!> 1*(3 #-�(3; G ����-��7By�}�!-/$+$#�!�y?K-4$#�+ +-/;�AK�7-/�!�[U.-4��?K� F ����?��5�_���3E��7BK��������$5Pv���S-/$���� G4G "%���T���y�+B^(*�

% ���� ��� ����� *&%�� � % � x �!{

(3��?

��(3 ���� ��� ��� � *)%!�"� %#� � x �_{

���CEH� G4G ����$Z?�-/ +�5&5� G , EH +�!>��+B��I?K�5¨^��-��7-/�!�]�*E�(y>:(3 +"*��?a�}�!-/$+$+�3� F �3-4�_� F +�.&��5$+$�U}�7B^(*�`-4�]�!A� C&)(3$#��7BK�C�+�3�d( G &5�!�_�7 +-/;�AK�+-4�!��$�-/�%�+� ��x���������{��3E}�7B��`$+��$#$+-/�!��$��3 +-403-4�^(*�+-4��0'-4���K�!�b~��T13�� G ( F�F -/��0�-4�_�7�5 #1*( G $x%$��'& � (3��?Wx%( � = � (* +��-/��?�� F �5��?����_��Pv��BK�� +��EH�! +�*UK-��\-/$\$#AK8�&�-/���_���7� F +�T13���7B������%A^(*�+-4�!�K$�x Ú {v(3�K? x ª {EH�! ��+B��Z&)(3$#�C��B��5�2�+B��Z-4�_�7�5��$+-���,�>��)(3$#A� +�Z-4$�&5�!��&5���_�7 +(*�7�5?��!�y(�¨^��-/�+��-4�_�7�5 #1*( G x)$ ��& � P���N�7B�-/$'&�(3$+�*U\�!AK �>I(* +"3�5? F �3-4�_� F #�b&5��$+$6&�(3�f;Y�I&��!��$w�7 #A�&5�+��? (3$�EH� G4G �T��$�P � ���!-4$#$+�!�f 7(*��?��!>1*(3 +-4(3; G �*� ��-��7BN>��)(3� 2 6bx%$��'& � 7 -4$'?K�5¨^���5?[PD� G $#��U�(�$#���%A����K&��2�3E�-uP -uP ?[PW +(3��?��!>  #�|Lb�+����?K��?�¡>:(3 +"%$Z-4$Z?���¨^����?lU���B��� #�I��(3&dBa>:(3 +"�-4$C(2 +(3��?��3>�EHA���&5�+-4�!� x+x ��� x��Y{��4�&� 0 {�� � + x)$��'& � {��3EVq 5�h1*(3 +-4(3; G ��$ � (*��? �|Pv� +��( G -/e)(*�+-4�!�=�*E��!A� F #�b&5��$#$�-/$�&��!��$w�7 #A�&5�+��?W;_,�¨^ #$#���d(3"%-/��0�(� #�)( G -4e)(9�7-4�3�=�3E�]U.�7B��5� F�G (*&�-4�K0,� F �!-4�_�+$�-4�_�+�`�7BK�V-4�_�7�5 #1*( G x%$��'& � -4��?�� F �5��?��5�%� G ,=(3&�&5�! +?�-/��0`�+�'�7BK�V?�-4$w�7 #-4;�AK�+-4�!�2�x = �#{ @A236bx%$��'& �87 U�(3�K?D¨^��( G4G ,O +(*�#�d(3&dBK-4��0!¡�¨^ #$#�#� ��L.�7�5��?���?a>I(3 #"%$Ix EH +�!> �7B���-uP -uP ?[P6$+�5�%A�����&5�T{�7���+B�� F �!-4�_�+$�P��B��V>:(3 #"Wx ��� x'�Y{��#��� 0 {v�3E}( F �!-/�%� G �.&)(*�+��?�(9� �v-4$�$#-4> F�G ,@�+B�� F #���#��&��7-4�3���3E�-/�+$��L.�+����?��5?W>:(3 +"I(*���7-/>:� �|P

��B��5�[U^EH�! +>�A G (3$Zx Ú {�(3��?ax ª {\EH� G4G ��� ?�-/ +�5&5� G ,IEH #�!>�x �_{�(3��?ax �%{|U� +�5$ F ��&��7-/13� G ,!P

-

Page 13: Load chracterization and anomaly detection for voice over IP traffic

�� �� � &���� �/& ��� �-��"

¦bA FKF �!$#�V���T�O�7B^(9���7BK��?^(*�7('$+�5$+$#-4�!��$�(3 +�S1!�!-/&���&�( G4G $v��-��7B=-zP�-zP�?lP�?�A� +(*�7-/�!��$5UbB^()1.-4�K0'�7B���?�-4$w�7 #-4;�Ab~�7-/�!��EHA���&5�+-4�!� �Nx��Y{��#� � 0 U���-/�+By�+B��'?��5��$+-���,���x'�Y{��#� � 0 Ul(3�K?�¨^��-��7�C>:��(3� � < PS��$+$#A�>:�C�7B^(9�&)( G4G $\(3 # +-/13�V(3&5&��! #?�-4�K0'�7�6(�BK�!>:�30!�����5�!A�$��}�!-/$+$+�3� F +�.&��5$+$���-/�+B=-4�_�+����$#-/��, : � 0 Ub(3��?=�+B^(*����(3&dB&)( G4G -/� F +�!0! #��$#$S03�����5 7(*�+��$S?^(*�d(@(*���+B��Z&��!�K$#�d(*�%�� 7(9�7� Ú P

�����7B�-/$�&)(3$#���7B��Z?�-/$#�7 #-4;�Ab�7-4�3�=�3E��7B��C(3>��!A��_���3E��7 +(*8�& �6x��������|{�?�� F �5��?�$S�!� G ,I�!� ����, �|U^$+�6�\���- G/G �� +-��7� �6x��#{ $* ��x 0 � �#{�UY(3��?��3;%1.-/�!A�$ G ,�%���x��#{ * x : @���{ �|P�� G �7B��!AK0!By�+B��`03�����5 7( G EH�! +>'A G (2x ª {&)(*��;Y�\( F�FKG -4�5?`?K-4 +�5&5� G ,��7���!;K�7(3-4����(3 ��6x��#{|U3-/�`�!AK �$ F ��&5-�( G &�(3$+�v�7B��\?��� #-/1*(*�7-/�!�C&)(3�`;Y�\$+�!>��5��B^(9�$+-/> FKG -/¨���?2;%,yA�$#-4��0I�+B��'�\� G/G "%���T��� Et(3&5���7B^(9�@xt-/� (�� @ ��� @ . �%A��5A���-/��0�$#,.$w�7��>I{S�+B��� 7(*��?��!>�%A�>�;<�� �� S�3Ev&)( G/G $�-/� F +�30! +�5$+$Z(*�V�+-4>�� 0 B^(*$Z�}�!-/$+$+�3� ?�-4$w�7 +-/;�AK�+-4�!����-��7B >��)(3� : @���U (3��? �7BK� +�5$+-/?�A^( G &)( G4G ?�A� +(*�7-/�!��$S(3 +�`-uP -uP ?[P\��-��7B2�7B��`?�����$#-/��, ����x��Y{ *���x Ú ,��cx��Y{+{�(3��?2�7B��`?�-4$w�7 #-4;�AK�+-4�!�EHA���&��7-/�!�����Tx'�Y{�*�� �! ����x#"�{-=$"<PZ� G $+��U[�+B��6�%A�>�;<�� ��3E\&)( G/G $S��B�-4&dBD�! +-/0!-4��(*�7�C-4� � 0 ��� � -/$Z�}�!-/$+$#�!���-/�+B�>:��(3� � ��*>:��|P

��E��\�Z?����K�3�7�

� 5x��#{ # * �7 +(*8�&C03�����5 7(*�+��?2-4� � 0 ��� � ;_,��^�T��$��7B^(*���\�� #�'( G +��(3?K, F +��$#���_��(*���7-/>:� 0 �

� ��x��#{ # * �7 +(*8�&C03�����5 7(*�+��?2-4� � 0 ��� � ;_,��^�T��$��7B^(*�S�5�%�+�� #��?�?KA� +-/��06�7B��Z-4�_�+�� #1*( G �

�7BK��� ��(3 �6x��#{�*���(3 �� 5x��#{ � ��(3 � ��x��#{����B��5 +�Ixz( F�FKG ,.-4��02x �%{+{

��(3 � �x��#{�* x8: @�� { 8 �!�%� � � x

%{w?%� � � x Ú ,&� � x��#{#{��

'

Page 14: Load chracterization and anomaly detection for voice over IP traffic

(3��?

��(3 � �9x��#{:�� * 8 �

!8 � <��!

� �� ��x � {w? � ? % � 8 �

!8 =� <��

x�� ,%{ �

� ��x � {w? � ?%

* 8 �!8 � <��!

� �� ��x � {w? � ? % �08 �

!x�� ,

%{ �

� x Ú ,&�cx���,%{+{w?% $

©��!��$#-4?��5 �������$ F ��&5-�( G &�(3$+�5$�P

% ���2�7B���¨^ #$#�)U��7BK�C&�( G4G ?KA� 7(*�+-4�!��-/$S�|L F �!�K���_�7-4( G U^-zP��*P/U ��x��Y{�* �Z��L F x-, � �Y{|P�¦.�7 +(3-403B%�#EH�! #��(3 #?&�( G &5A G (*�+-4�!�K$�,.-4� G ?

��(3 ��x��#{�* ª :��� � ,

ª :��� x Ú ,�� <�� � { $ xu¢3{

��E��\�2?K�����3�+��;_,��6x��#{ $* �6x��#{ @��C�7B�� xt 7(*��?��!>I{'()1!�5 7(30!���%A�>';Y�5 6�3ES&)( G/G $'-/�f(3�N-4�_�+�� #1*( G�3E G �5��03�+B �|U�;_, $ * : @��f�7BK��>��)(*�]�%A�>�;<�� Z�3E�&)( G/G $5U�(3��?D;%,� * � ���7BK�:>��)(3$#A� +�5>:�5�_�-/�%�+�� w13( G�G �5��03�7BM���! #>I( G -4e5��?N;_,N�7BK�2>��)(*�M&�( G4G ?�A� 7(9�7-4�3�[Uv�+B����M���2&)(*� #�5�� +-��7�]xu¢3{'-4�M( #�K�! +>:( G -/e��5?�¡'EH�! #> #

��(3 ����x��#{�* � �� x)$b{ $* ª $ � < � , Ú �� � $ x �!{

��B�-/$'-/$C�+B��:EH�! #>�A G (�EH�3A���?c;_,��S-/�! +?�(3� � ' � PaxH��B��I�|L.�7���K$+-4�3�c�7�y�+B��I&�(3$+����B����c�+B��� #�I-/$�!� G ,�(�¨^�K-/�7�Z�%A�>�;<�� ��3EV w�+ +A���"%$#¡I()1*(3- G (3; G ��EH�! �&�( G4G $���(*$��!;b�d(3-/����?�;_,�¥��5�����$ � � � P {

% §S����(3$+$#A�>��Z�+B^(*�S(@&)( G/G ?�A� +(*�7-/�!��B^(3$S(@��(* +�5�+�:?K-4$#�+ +-/;�AK�7-/�!�[P��2�! +� F #��&�-/$+� G ,!U�EH�3 � � 0 U

Ú , �cx � {�* Úx � � Ú {�� � Ú ,&� � x � {�* Ú

x � � Ú {�� < $�O-��7B�$+-/>:- G (3 v&)( G &�A G (*�7-/�!��$5U

��(3 ��x��#{�* ª :x Ú ,���{�x ª ,���{5x ��,���{ � Ú , Ú

x�� � Ú {�� < ��� � ª :��x Ú ,���{�x ª ,���{ $

��� G (9�7��?�&�( G &5A G (*�+-4�!�K$�EH�! ��Z(3A�$+$#-�(3��$#�!A� +&5��$����5 +�C?��!���Z-/� � � � PÚ10

Page 15: Load chracterization and anomaly detection for voice over IP traffic

� ���� !� ��� � ��� ����� �'� � �)� ����}��)��� � � �'� �

���c���������! #":>:(3�^(*0!��>����_�v$#,.$#�+��>�$\��, F -/&)( G/G ,6A�$#�����`>:�3 +���7B^(*�2��qui3qzsur�q�2.�7pd� 2^h9g�j9���7�C?��5�+��&5���T1!�� �~G �!(3?[P��OB�- G �C(:¨^ +$w�V�! #?��� �$#�7(*�7-/$#�7-/&3U�$+AK&dBX(3$��+B��6()1!�5 7(30!� G �_(*?[U�&)(3� F +�T1.-4?��`A�$+��EHA G -/�KEH�! +>:(*�+-4�!�EH�! S���!�b~ F ��(3"3�5? ?^(*�7(KUlB�-/0!B��5 ��! #?��� �$#�7(*�7-/$#�7-/&�$S&)(3� F +�T1.-4?��`>�A�&dBW>��! +�` +��¨^����? -/�KEH�! #>I(*�+-4�!�=EH�3 �513���N(� #-4&dB��5 Z1*(3 #-4����, �3Ev�7-4>��6$+�5 +-/��$�P:�^�! ���LK(3> F�G �3U �7B�� F �)(3"%$C�3E��+B��61*(3 +-4(3��&��@�3E\&��3A��_�7$C-4�D(¨KLb��?.~�$+-/e��5?�>��T1.-4��0V��-/��?��T�f��-/�7BK-4�@(��7-/>:�\$+�5 +-4�5$ F #��1.-/?���$v(3�6-/��?�-4&�(*�7-/�!�'�*El(*���!>:( G �!AK$};<��B^()1.-4�3 -4���7BK�'A���?K�� G ,.-4��0 F +�.&��5$+$5Ul;<�3�7B2EH�! S(*��, F -4&�( G4G ,�B�-403B�(3$��\� G4G (3$ G �T� ;_,%�7�`&��!AK�%�+$�P����I- G/G A�$w�7 +(*�7��7BK-4$���-��7B �!A� �?^(*�d(bUl��� FKG �3���7B���1*(3 #-�(3��&5��xH�3E��7B��6 #��$+&�( G �5?�{�;_,%�7�@&��3A��_�7$V��-/�+BX(��9~�?�(*�d(9~ F �3-4�_�7$��-4�K?��T� x � 0 >:-/�.Ab�7��$7{��3E��7BK�@���3��� �7 +(*8�&@(3��?X&��3> F (* +��-��V��-/�+BX�+B�� F #�3¨ G �'�3E\�+B����7-/>:�`$+�5 +-4�5$-/�+$+� G E�Ub�+B^(*�SB^(3$�$#�!>:���3;%1.-/�!A�$S(3���!>:( G -4��$5UK(*$S$#B��T����-/�y�}-40!A� #����P

��$�-/�S&)(*��;<�`$#�����lUY�7BK�`�7 #-/1.-�( G (3���!>:( G �!A�$�;Y�5B^()1.-4�! �&��3 + +�5$ F �!��?�-/��0:�+�I&�( G4G ~�&��3A��_�#~�?K +� F $�~��+�*~�e5�� +�(3 #��xt�|Lb�+ +�5>:� G ,K{S�\� G4G ?��5�+��&5�+��?X;_,��+B�� F ��(3"%$�-4���+B��2xt>��T1.-4��0%{�1*(3 +-4(3��&5�3PZ��B��6$7(*>:��BK� G ?�$��7 +AK�EH�! ��+B��Z��� �7 +(*8�&3U���-/0!A� +�C¢.U^( G �+B��!A�03B=�7B��Z$ F ��&��7 #A�> B��� #�`-/$�EHA G4G �� ��+B^(3���7B�(*�S�3E}���3���}P

��B��WAb�7- G -/��,f�3EZ$#��&5�!��?O�! +?K�� I$w�d(*�+-4$w�7-4&5$:EH�! �EHA� #�+B��� I?��5�+��&5�+-4�!�J�*EC(3���!>:( G -/��$5U�;<�3�7B F �)(*".$�(*��?�7 #�!A�0!BK$�U_-4$}�7B��5 +�5EH�3 +��& G �)(3 5P�QS���\�513�� 5U ª �K?@(3��?@B�-403B��� ��3 +?��5 �$#�7(*�7-/$#�7-/&�$ F +�T1.-4?���(VA�$#�5EHA G >��)(*$+A� #�(3$ G �!�K0I(3$��7BK��-4 � +(3��0!�C�3E�1*(3 #-�(3;K- G -���,I-/$�".�K�������! S(*� G �)(3$w�S&)(3�y;Y� F +�5?�-4&��7�5?[P���B�-4$S-4$���B^(9���7BK�1*(3 +-4(3��&5�IEH�! +>'A G (3$`?��� #-/13��?M-4�c�7BK� F +��1b-/�!A�$6$#��&5�+-4�!�f(*��?f-4� F (3 w�7-/&�A G (3 ��-4�! #?^(3� � $'EH�! #>�A G (cx �!{F #��1.-/?��3P

� � � �'�!� !����� �@� �c� �� � �W��� ���)� �

©��!��$#-4?��5 V(6���!��� G -/��"�U�(3��? (3$#$+A�>��C&)( G/G ?KA� 7(*�+-4�!�K$�?��:B^()1!�`��L F �3�����_�7-4( G ?�-4$w�7 +-/;�AK�+-4�!�[P\��$#$+A�>��( G $+���7B^(9����(3&dBI&�( G4G 0!�5���� +(*�7�5$v�+ 7(*8�&�(*�\(C&5�!��$w�d(3�_�\ 7(*�+� ��Ub(3��?@�7B^(9�v�+B��S>:��(3�:&�( G4G BK� G ?�-/��0V�7-/>:�Ú @��]-4$S"%���T���[P���B�� G �5��03�7By�3E�(:�+-4>��Z-4�_�7�5 #1*( G �T1!�� ���B�-4&dBW;_,%�7�'&��!A��_�+$V(3 #�'&�� G4G �5&5�+��?�-/$ �|P'xz�^�! ( G/G �7B��@�|L�(*> F�G ��$Z-4� �+B�-4$ F ( F �� 5U � * ¢=>�-4�[P {c��B����[U ��-4�! #?^(3� EH�! +>'A G ( F #�T1b-/?���$`(3�D(3�^( G ,%�7-/&)( G

Ú@Ú

Page 16: Load chracterization and anomaly detection for voice over IP traffic

0

1e+08

2e+08

3e+08

4e+08

5e+08

6e+08

7e+08

8e+08

0 200 400 600 800 1000 1200 1400 1600 1800 2000

Inbo

und

VoIP

traf

fic m

easu

red

in by

tes

Time in units of 5-minutes

0

500

1000

1500

2000

2500

3000

3500

4000

4500

5000

0 200 400 600 800 1000 1200 1400 1600 1800 2000

881

varia

nce

with

15

minu

te w

indow

Time in 5 minute intervals

��-/0!A� +� �$# �d°¬Ä>Å ·À¶ºÁLÂ�¯u̬°g¼£Ëa¾p® � ·À°¬¹�Ó�ÐgË�¶º® ��Á¬±aµ�³½·´²B±�°¬¶Ò¾jÁ¬¼£³���®+µ�ÌLÁ ¶º³�Á¬±a¯�® � ¾p®+Á¬²´Ë�¶´®+µ�³£±�Ëa±a³£·´² °¬¿K¯�Á¬¼�¼£²��¯�Á¬¼£¯�Ëa¼�Á ·À®+µ�Ëa²´³£±aÐ�ÁjÆO³£±aµ�°hÆ�²´³���®)°¬¿|²´³ Ô�×hÊ_¾j³£±-Ë�·À®¢³£±Y·À®�¶´Ì Á¬¼£² � ���j¾j³�±�È �

Ú�ª

Page 17: Load chracterization and anomaly detection for voice over IP traffic

0

5e+07

1e+08

1.5e+08

2e+08

2.5e+08

3e+08

3.5e+08

4e+08

4.5e+08

0 200 400 600 800 1000 1200 1400 1600 1800 2000

Inbo

und

IP tr

affic

mea

sure

d in

byte

s

Time in units of 5-minutes

0

200

400

600

800

1000

1200

1400

0 200 400 600 800 1000 1200 1400 1600 1800 2000

823

varia

nce

with

15

minu

te w

indow

Time in 5 minute intervals

��-/0!A� +��¢ # � Á ·´ÁLÊS°g±a¼½Ã�Ä�ÅÖ·À¶ºÁLÂ�¯¢Ì¬°g¼£Ëa¾p® � ·À°¬¹�ÓDÐgË�¶´® ��Á¬±aµ1³½·´²*±a°¬¶º¾jÁ¬¼£³���®+µ�Ì Á ¶º³£Á¬±�¯�® � ¾j®+Á¬²´Ë�¶´®+µ�³�±1Ëa±a³½·´²°¬¿7¯�Á¬¼£¼£² �d¯�Á¬¼£¯�Ëa¼�Á ·À®+µ�³£±�Á¢ÆO³�±aµ�°©Æ�²´³���®O°¬¿P²´³ Ô�×hÊ_¾j³£±-Ë�·À®�³�±f·À®�¶´Ì Á¬¼£² � ���3¾j³�±�È �¢Å ¶´° ÓD¼½®�°¬¿�·´¸�®OÄ�Å�·À¶ºÁLÂ�¯ � ·À°¬¹Ó�ÐgË�¶º® ��Á¬±aµ�³½·´²�±a°¬¶º¾jÁ¬¼£³���®+µ�Ì Á ¶º³£Á¬±�¯�®+² � ·À°�¯�Á¬¼£¼7¯�°gË�±f·��B¯�Á¬¼�¯�Ëa¼£Á ·À®+µ�Æ�³½·´¸1Á�ÆO³£±aµa°©Æ�°¬¿d²´³���®�� � ����¾j³£±�È �

Ú �

Page 18: Load chracterization and anomaly detection for voice over IP traffic

��L F #��$#$+-4�3�fEH�3 `�7BK�I1*(3 +-4(3��&��:�3E��7BK�=;_,.�+��&��!AK�%�+$�U��B�-/&dBN-4$'AK$+�5EHA G -4�c?K�5�7�5&5�+-4��0 B�-/0!B G �_(3?N(*��?(3;��K�! +>:( G �+ 7(*8�&�;Y�5B^()1.-4�! 5P�¥�(3$#��?:�!���+B�-4$�EH�3 +>�A G (KU3�\��&5�!��$w�7 +AK&5�\(C$#�5�v�3EY�7 7(98:&S(3�K�!>I( G ,C�7��$w�7$5Pxz�^�! �>:�! #��>:�.?��5 +�6A�$#��$v�3E��7B���$7(*> F�G ��1*(3 +-4(3��&5��EH�! �?����7��&��7-/�!�:�*El(*���!>:( G -/��$�(*��?�(3;� +A F �v&dB^(3��0!�5$-4�����������3 +"=�7 +(*8�&3U^$#��� � �KU - U Ú�ª � P {��, F -4&)( G4G ,3U[�7B� #����&��!�K?�-/�+-4�!��$������5?]�7��;<�@&dB���&d"*��?c��B��5�a�!����( FKF�G -/��$Z(�>:�.?�� G �7�]xH�+ 7(*8�&){�?�(*�d(KP��-/ +$#��Ul�7BK�@( F�F�G -4&)(*;�- G -/��,��3E��7BK��>��.?�� G �7��>��)(3$#A� +�5>:�5�%�+$Z�����5?�$C�+��;Y���+��$w�7��?lP6��B�-4$�-/$��7��&dB��5&d"�7B�(*���+B��'?�(*�d(�>:�5�5�S�7B��'(3$+$#A�> F �7-4�3��$�>:(3?��C-4�2�7B��C>��b?�� G P�¦.��&��3��?[U[(@�7�5$#�V�K����?K$��7�:?��5�+�� +>�-4�K�-/E�(3��?2��B���� >��)(3$#A� +�5>:�5�_�7$�-/��?�-/&)(*�+�C�K�! +>:( G �! �(3;����3 +>:( G G �_(*?y;<��B^()1.-4�3 �U�0!-/13�����+B^(*�S�7B��C?^(*�7(

F (3$#$��7B���¨^ #$#���7�5$#�)P���B�-/ +?[U�(@¨^��( G �7�5$#�S&dB��5&d".$SEH�! ��T1!�5 �*A��K?��� G �_(3?lPv��BK��$+�C�7�5$#�7$5U^�! Ci3g�i3�|m'��U^(3 #�?����d(3- G ��?�;<� G ���ZP

� �� ����������� &� ����� �'���� �� � 5� ���

��B�-/$�( G (3 +>�-/$}-/$+$#A���?'��BK���'�+B����5> F -/ +-/&)( G 1*(3 #-�(3��&5��$��d(3"*���6�T1!�5 �(S$ G -/?�-4�K0S��-/��?��T�N�3E��+B���$#���%A��5��&���3E\;_,.�+��~�&��!A��_�+$ � � � ��* Ú � ª � $ $ $ xH��B��5 +� ��-4��?��|Lb��$��7B��@&5�!��$+�5&�AK�+-/13�=¢�~�>:-/�%AK�7�6-/�%�+�� w13( G $d{|U ?�-"!Y�� $+AK;�$#�7(3�_�7-�( G4G ,`EH +�!> �7B����+B����! #�5�+-4&)( G 1*(3 +-4(3��&�� F #��?�-/&5�+��?�;%,'�7B�����-4�! #?^(3�6EH�! +>'A G (KP�¦bA�&dBI(3��( G (* +>-4�K?�-4&�(*�7�5$Drdh9kK��s4��q�p�klr�n��! �� &5�!�KEH�! #>I(3�K&�� �\�3EZ�7B��y�7 7(98:&�$#�d(9�7-4$w�7-/&�$I��-��7B �+B��!$+� �*E����!��� �+ 7(*8�&3P�}�3$+$+-/; G �Z #�)(3$#�!��$�EH�! ��7 +(*8�&�� ���3�b~�&5�!�KEH�! #>I(3�K&�� ��(3 +� #% � $+-/0!��-�¨^&)(3�_��EH 7(*&5�7-/�!�2�3E��+B��C�+ 7(*8�&Z-4$Zklh9q ���!����P ��1.-4?K���_� G ,!U�-/E}A�$+�5 �?^(9�d(@$+��$#$+-/�!��$�?K�:���*�0!�5���� +(*�7�C(6&��3��$#�7(3�_�� +(*�7�V�+ 7(*8�&:xz(3$�13�!-4&5�C&�( G4G $�?��%{|U �S-/�! +?�(3�=EH�! +>'A G (�?��.��$����*�S( F�F�G ,!P

% ��1!�5�f-/E��7 +(*8�&=-4$C���!���}U �S-/�! +?�(3�]EH�! #>�A G (y>:(T, F #��?�-/&5�@(� w�� +�!�K0!¡W1*(3 +-4(3��&��*U�-/E��+B��=&�( G4GB�� G ?�-/��0��7-4>���-4$v���3�\��L F �!�����_�+-�( G �! ��7B���(3&5�+A^( G >:��(3�I&�( G4G ?KA� 7(*�+-4�!��-4$v?�-&!l�5 +���_�\EH +�!> ��B^(9��\�C(3$+$#A�>:�C-/��-4$�P

% ��B����+��$w��>:-/0!B_��Et(3- G ?�AK���7���7B���-4��B��5 +�5�%���K�!�b~�$w�d(*�+-4�!��(3 +-���,`�*EY?�(*�d(KP}��B�-4$ F +�!; G ��> &��!A G ?6;<�&5-4 +&5A�>'13���_�7�5?�;_,Z +��>��T1.-4��0��7B���+ +���K?�$�-/�Z�+B��v?^(*�d(bP}��B�-/$}&�(3�C;Y�v?��!���v-4�C(�$#�+ 7(3-/0!B_�+EH�! w��(3 #?

Ú �

Page 19: Load chracterization and anomaly detection for voice over IP traffic

��(),!P

% ��1.-4?��5�_� G ,3U����3�b~�&5�!��$+-/$#�+����&�,f&)(3�M;Y��&�(3A�$+�5? ;_,N&5�!�_�7-4�%A^( G >:-/$ G ��(3?�-/��0W�! 6Et( G $+��>��)(3$#A� +�|~>����_�7$5P

��E��7B�-/$�( G (3 +> -4$\-4��?K����?�-/$+$+AK��?[UK�+B��V��, F ���#�v(3��?��+�#�v( G (3 #>:$\?���$#&� #-4;<��?�-4�I�+B��V$#A�;�$+�5&5�+-4�!��$�;<� G ���ZU��B�-/&dBci9�d���.mIp�>��)(*$+A� #��>����_�7$S(3 #�Z���3���}U�$#B��!A G ?y;<��-40!�K�! +�5?2;<��&�(3A�$#�C�+B��Z&�A� # +���_���7�5$#��-4��?K-4&)(9�7��$

G (*&d"=�3E�(30! +�5��>����_��;<�5���\�������!;�$+�5 #13��?W>��)(3$#A� +�5>:�5�_�7$S(3��?��7B��Z>��b?K� G P

���:;<� F +�5&�-/$+�3U^�\� F +� F �!$#�Z�+B���EH� G4G �T��-4��0 F +�.&���?KA� +�*P

% ©��!�K$+-4?K�� :�+B���$#���%A��5��&��X�3E�;_,%�7�|~�&5�!A��_�7$ � � �*� * Ú � ª � $ $ $ xH��B��5 +�*U�(*$I;<�5EH�! #�3U �'-/��?��|LK�5$�+B���&��!�K$+��&5AK�7-�1!�'¢�~�>�-4�%AK�+�V-4�_�+�� #1*( G $d{|UK�T1!�5 �( G �!��06�!;�$#�� w13(9�7-4�3��-4�_�7�5 #1*( G � UK��, F -/&)( G/G ,:>I(3�_,B��3A� +$��! �?�(T,.$5P���B�-/$�-/$S�+B��Iqt�#i3s k^s k��`�! Cg4p+i3��k^s k��Z-4�_�7�5 #1*( G EH�! S&dB^(3 7(*&5�7�5 +-/e)(*�+-4�!�2�3E?^(9�d(I(9�B^(*��?[P

% �^�! 2�)(3&dB �+UZ&��!�K$+-4?K�� W(J��gostj3s k��05s k<j.h/5R&5�!��$+-/$#�+-4��0 �3E�� x ��, F -4&�( G4G ,��9~ ÚTª {=;%,%�+�c&��!AK�%�+$� � <�� ? �� $ $ $ � � ��P � �5� �� ��*�x Ú @��[{�� � � � <�� ? � ;<���+B���-/ '()13�� 7(*0!�3Py©��!> F AK�+���+B�� xH���! w~>:( G -/e��5?�{v�5> F -/ +-/&)( G 13(* +-�(*��&��

� �� # * � �� �

Ú� , Ú

�� � � <�� ? x � , �� �H{ � �

��B��5 +� �X-4$��7B��`?^(*�7(� +(*�7�C0!���K�� 7(9�7��?�;%,2�!�K�`&�( G4G -/� F #�!0! +�5$+$5P���B��'�5> F -/ +-/&)( G 1*(3 #-�(3�K&�� � ��$#B��!A G ?:;<��& G �3$+���7���7BK�S�+B����! #�5�+-4&)( G 1*( G A�� � �� x)$b{|U%0!-/13����;%,6�+B����S-/�! +?�(3�6EH�! +>�A G (@x �!{�U_��B��� #��\�:$#�5�#$y�+�y-��7$���$w�7-/>I(*�+� �� � @�x � �#{�Pyxz§S�3�7�6�7B�(*�C-/�Z>:(T,�;Y�@���5&��5$+$7(* #,D�7�� +�5>:�T1!���!;_1.-4�!AK$G -4����(3 ��7 +�5��?�$5U[���! #>I( G -4e5�V�7B���¡3���!-4$#��¡��7�� #> -4���+B��' #��0! #��$+$#-4�!��>:�.?�� G (3�K?W0!���K�� 7( G4G ,�& G ��(3��+B���?^(*�7(���-/�+B�-4�`�)(3&dB@$ G -4?�-/��0���-/��?��T�M;Y��EH�! +��&)( G &�A G (*�7-/��0S�+B���1*(3 #-�(3��&5�3P}��B�-4$���(3$?��3���3U3EH�3 �|L�(*> F�G �3U[�+�2�3;K�d(3-/�X��-403A� +�5$ �2(*��?��bP���B��5$+�:(3 +�6$w�d(3��?�(3 +?D$#�7(*�7-/$#�7-/&)( G �7�5&dB���-4�%A��5$C��BK-4&dB�\����- G4G ���3��� G (3;<�! 7(*�+��B��� #�3P {

Ú ¢

Page 20: Load chracterization and anomaly detection for voice over IP traffic

% �^�! \�)(3&dB �#U�&��!> F (3 #���+B��V��> F -/ +-4&�( G 1*(3 +-4(3��&�� � �� �7����� �� x%$.{�U.��B��� #���'-4$�('¨KLb��? F (* 7(3>��5�+�� �U��, F -/&)( G/G , Ú�� � ��ª P����I��1!���_� � �� ����� �� x%$.{�������- G/G &)( G4G (@�Tsuh9g�i3qzsuh9k^P � ;%1.-/�!A�$ G ,!U_EH +�5�%A����_�1.-4� G (*�+-4�!��$\-4��?K-4&)(9�7�V�7B�(*���7B������!��� �+ 7(*8�&C(3$#$+A�> F �7-/�!��$�?������3�SB�� G ?[P��B��5 +�5EH�3 +�3U^�\�`-/$+$#A���+B��'( G (3 #> -/E\q'2^p\�|�7p����^p�klr�n�h��C�Tsuh9g�i3qtsuh9kK�Cs4�Cq�hTh�2.s �/2'�! Zqzs mIpd�`s k^q�p��|�9i3g �65s q�2^h9�.q��Tsuh9g�i3qtsuh9ki3�7pCq�hTh�� 2^h9�|qzP�x� w�}�.�@B�-40!BK¡@(3��?  w�7�.�6$+B��3 #�7¡�-4$�$ F �5&�-�¨^��?2;_,2(3?�?�-��7-4�3�^( GlF (3 7(3>��5�+�� #$�P {

��-/0!A� +� - - G4G AK$#�7 +(*�7�5$��7BK� F +�.&���?KA� +�*P:§S�3�7-/&���( G $+�=�7B�(*�C-/E �f-4$�&dB��!$#���D�7�.�2$#>I( G4G UY�7B��@��> F -/ +-4&�( G1*(3 +-4(3��&5�V��- G4G ���3��;<�Z(6 +� G -�(3; G ���5$#�+-4>:(*�7�! ��3E�(*&5�7A�( G 1*(3 +-4(3��&5�3UK��B��5 +��(3$�-�E � -4$�&dB��!$#���2�7�.� G (3 #0!�3U�7BK�:�5$#�7-/>I(9�7�! �>:(), ;Y�@;^(*?a?�A��@�7�2���!�.~�$#�7(*�7-/�!�^(3 #-/��,��3E\�+B���?^(*�d(bU}-zP��*P:;<��&�(3A�$+���7B���-4�K?�-/1.-4?KA^( G�!;�$#�� w13(9�7-4�3��$S(3 +�����*� G -4"*� G ,��7�@$w�7��> EH #�!> �+B��Z$7(3>��Z?�-4$w�7 #-4;�AK�+-4�!�lP

��-/0!A� +�5$ �I(3��? ��$#B��T���7BK�' +�5$+A G �S�3E��+B���(3;<�T1!� F +�.&��5?�A� #�`EH�! ��7BK�C���!���J(*��?���� �+ 7(*8�&3U� #��$ F ��&|~�7-�1!� G ,!UY��-/�7B �+B��6$ G -4?�-/��0:��-/��?��T�R$#-4e5�6�3E ��?�(*�d( F �!-4�_�+$@x � 0 >�-4�%AK�+��$7{V(3��?�� * Ú P`�^�! ��+B��6�)(3$#��3E�&��!> F (3 #-4$+�3�[U\�+B����5> F -/ +-/&)( G 1*(3 #-�(3�K&���$:(3 #�y #��$+&�( G �5? $#�]�7B�(*�:�+B��2&��! # +��$ F �3��?�-4�K0]�7BK���! #�5�7-/&)( G1*(3 +-4(3��&5�`-/$�( G ��(),.$�� �� x Ú {�P����I� G -/>:-/�^(*�7�V�+B��C�^(*�7AK 7( G �7 #����?K$ F +�5$+�5�%�V?�A� +-/��0@13(* +-4�3A�$ F �� #-4�.?�$��3E�7BK�C?�(T,3U G -/���)(3 � +��03 +��$#$+-/�!�2��(3$SA�$+�5?2�+�:¡3���! +>:( G -4e��5¡'�7BK�C?�(*�d(KP

��$6-���&�(3�N;Y���3;�$+�5 #1!�5?MEH #�!> �7B��5$+�=¨^0!AK +��$5Uv�+B��=�%A�>�;<�� 6�*E�1b-/� G (9�7-4�3��$CEH�3 '�7B��=���3��� �+ 7(*8�&=-/$$+AK;�$#�7(3�_�7-�( G4G ,�$#>I( G4G �5 �xz¢bP ���@{��7B�(3���7B�(*���3E������7 +(*8�&�x Ú ��P ���{|PV��B�-/$�-4$�-4� (*0! +�5��>����_����-��7BW�7BK�¨����*Ev�+B��'�+B����! #�5�+-4&)( G >��b?�� G �+�=���!��� (*��? -/�+$ G (*&d"y�3Ev&5�!�KEH�! #>I(3�K&��'�+�=��� �+ 7(*8�&�x �7B^(*�V-4$V>��! +�;�A� #$#��,K{�Pv��B�-/$��\�!A G ?� +��$#A G �S-/�2$#�5�#�7-4�K0��*E}�+B��Z�v, F �`��( G (3 #> EH�! ����M�7 7(98:&C(3�K?2�K�3��EH�! ����!���}U�(*$��L F ��&��7��?lP

� �� ���"��� & � ������������� � �-���� �� �! � � ���

��B�-/$Z( G (3 #> -/$V-4$#$+A��5?D��BK���X�7B��@&�AK + +�5�_�`;_,%�7�@&5�!A��_� � �Vp�s q�2^p���i���h9�3p:h9����p�g4h/5Ul�7BK�2xt$7(),K{ ' ¢�&��3�K¨^?��5��&��V-/�_�7�� w1*( G^F +�5?�-4&��7�5?=;_, ��-4�3 +?^(3�6EH�! #>�A G (���-��7B��7B��S>:��(3� G �_(3? $�$+���\�+�`�7BK�Z� 2^h9�|q���q�p��|m��> F -/ +-4&�( G >:��(3� G �_(3?=�7(3"3�5�y�T13�� ª ~ � G (3$#��>��)(*$+A� #��>����_�7$5Pv��$����3�7�5?�;Y��EH�! +�*U��7B�-/$ F +�.&��5?�A� #�`B^(*$�7�:;Y�`��Lb��&5AK�7�5? �!� G ,�-/E���, F �'��( G (3 +> -/$��K�3��-/$+$#A���?[UY-4�y�3�7B��5 S�\�! #?�$�U<�7B��5 +��-/$����:$+A�$ F -4&5-4�!�2�7B^(9�

Ú �

Page 21: Load chracterization and anomaly detection for voice over IP traffic

0

0.2

0.4

0.6

0.8

1

1.2

1.4

1.6

1.8

2

0 200 400 600 800 1000 1200 1400 1600 1800 2000Norm

alize

d sa

mple

varia

nce

& th

e Ri

orda

n es

timat

e ba

sed

on a

30

minu

te w

indow

Time in units of 5 minutes

��-/0!A� +� � #�� °g¾p¹�Á ¶º³£²´°g±�°¬¿^·´¸�®�²´Á¬¾p¹�¼½®�Ì Á ¶º³£Á¬±a¯�®pÆ�³½·´¸�Á1ÆO³£±�µ�°©Æ[²´³���® �1·À°�·´¸�®p·´¸�®�°¬¶´®�·´³�¯�Á¬¼ ��� ³£°¬¶ºµaÁ¬± �Ì Á ¶º³£Á¬±a¯�®)¿Î°¬¶�·´¸�®�±a°¬¶º¾jÁ¬¼£³���®+µ��d°¬Ä�Å�·À¶ºÁLÂ�¯

0

0.2

0.4

0.6

0.8

1

1.2

1.4

1.6

1.8

2

0 200 400 600 800 1000 1200 1400 1600 1800 2000Norm

alize

d sa

mple

varia

nce

& th

e Ri

orda

n es

timat

e ba

sed

on a

30

minu

te w

indow

Time in units of 5 minutes

��-/0!A� +��� #�� °g¾p¹�Á ¶º³£²´°g±�°¬¿^·´¸�®�²´Á¬¾p¹�¼½®�Ì Á ¶º³£Á¬±a¯�®pÆ�³½·´¸�Á1ÆO³£±�µ�°©Æ[²´³���® �1·À°�·´¸�®p·´¸�®�°¬¶´®�·´³�¯�Á¬¼ ��� ³£°¬¶ºµaÁ¬± �Ì Á ¶º³£Á¬±a¯�®)¿Î°¬¶�·´¸�®�±a°¬¶º¾jÁ¬¼£³���®+µ�Ä�Å ·À¶ÒÁLÂ�¯

Ú �

Page 22: Load chracterization and anomaly detection for voice over IP traffic

�7BK�Z�+ 7(*8�&Z-4$��K�3�����!���}P

��B�-/$6( G (* +>�>:(T,D;<�=&)(*A�$+�5?M;_,a(��%A�>�;<�� ��*E��51!�5�_�7$�PD� ¨^ #$#� F �!$#$+-4; G �I&�(3A�$#�=-4$'( G -/��" Et(3- G A� +�$+�3>:����B��� #��-4�'�+B������������! #"�P��B�-4$�Et(*- G AK +���7 +-/0!0!�5 +$� #�� #�!AK�7-/��0V�3E<&�( G4G $�U*�+B%A�$ G ��(3?�-/��0��7�V(3�6� !Y��&��7-/13�

G �!(3?�-4��&5 +��(3$+��! l?���&5 +�)(*$+�3P������3�+B��� #�)(3$#�!�C>I(),�;Y��(�$+AK?�?����Z�7 +(*8�&�-4��&5 +�)(*$+�?�A����+�S(3��� �|Lb�+�� #�^( G ��513���_�)U<-uP �3P�U�(3���513���_�VAK�� +� G (*�+��?��7�6�7B��C���������! #"�P�� G $+��(@>:��(3$+A� #��>����_��Et(3- G A� +��>:-/0!B_� G ��(3?2�+��(3�( G (3 +>2P

�^ +�!> �|Lb�+����$#-/13�6>:��(3$+A� #��>����_�7$��3E��7� G � F B��!���`�7 7(98:&*UY�\���!;�$#�� w1!���7B�(*���+B�� G �_(3?�-/��� Ú ¢:>�-4�%AK�7�-4�_�+�� #1*( G $�&�(3�@;Y���+ +��(*�7�5?:(*$�(V$#�d(9�7-4�3�^(3 #, F #�b&5��$#$�P�}(3"%-4��0V�+B�-4$(*$(3�@(3$#$+A�> F �7-/�!�[U3�+B�� F #�b&5��?�A� #�EH�! �-/$+$+AK-4��06�7BK�`( G (3 #> -/$�(3$�EH� G4G ����$ #

% ¦b-/>:- G (3 G ,C�7�'��, F �����7�5$#�)UK&��!> F AK�+�V()1!�5 7(30!�5$ �� � �3E�;_,%�7��&��!A��_�+$ � � �T1!�5 �('$ G -4?�-/��0`��-/��?��T��3E}$+-/e�� ��P��, F -4&�( G 1*( G A��VEH�3 �D-/$�EH +�!> ª �7� ��P

% ��0_(3-4��(3$�-/�y��, F �����7��$w�)U<���6(*$+$+AK>:�'�+B^(*� $�� �� � @�x � �#{�U<$+�=�+B��`�+B����3 +�5�+-4&�( G 1*(3 #-�(3�K&��'�*E�(;_,%�7�C&��!AK�%�S-/$ � �� x $b{�P

% ©��!�K$#�7 #A�&5�V(:&5�!�K¨^?��5��&��'-4�_�7�5 #1*( G x��� �4, ª � �� x $b{�� �� � � ª � �� x $b{#{�P���E��7B��`���5� >��)(3$#A� +�5>:�5�_�� � ? �-/$��!AK�7$#-4?����+B�-4$�-/�%�+�� w13( G UK-/$+$#A����7B��C( G (3 +>2P

� � ;$�������(��� �'& � � � �-���� �� �! � � � ���

��B�-/$�( G (3 #> -4��?�-/&)(*�+��$��+B^(*���+B�� G -/��" G �_(*?=-4$��+�b�6BK-40!B[P�����-4$�-/$+$#A���?���B������+B���&�A� # +�5�%�S;_,%�7��&5�!A��_�xt�3 ��+B���?K�� +-�1!�5?I�%A�>�;<�� v�3E &�( G4G $d{���Lb&5����?K$�(`&�( G &5A G (*�+��?@�7B� #��$#B�� G ?�1*( G A��*U � � � �)U%��BK�� +� � ��-/$( F #��?���¨^����?2�7B� #��$#B�� G ?lU^(3��?��7BK�V¨^ +$w�S( G (3 #> -4$����*��$+�5��P���B��V1*( G A����3E � �S-/$�$#�7(*�7-/&3U�-���-/$�(�¨KLb��?EHA���&��7-/�!�W�3E��+B�� G -4��"�$ F �5��?� (3��?��\��$+BK��� ;<� G �T� B��T� -���-/$�&��3> F Ab�7��?lP���, F -4&)( G4G ,3U<�+B�-4$�( G (* +> +�5�%A�-4 #��$$+�3>:��-/>:>���?�-4(*�7�v(3&��7-/�!�@(3$ G -/��"Z�T1!�� G �_(*?����!A G ?@ +�5$+A G �-4� F (*&d"3�5� G �!$+$#��$�(3��?6&5�!��$#���%A����_�1!�3-4&����%A^( G -/��,�?����7�5 +-4�3 7(*�+-4�!�[P}�a�V�K�3�7�V�+B^(*��$w�d(*�+-4&��+B� +�5$+B�� G ?�( G (* +>�$�U.$+A�&dBy(3$��+B�-4$5U�(3 #�V�7B���>��!$#�&��3>:>��!� G ,WA�$#��?a-/�]�K�5���\�! +"X>:(3�^(30!�5>:�5�_�)P���B��:>:(3-/�D?K-"!Y�� +�5��&���;<��-4�K0��+B^(*�Z�7BK���+B� +�5$+B�� G ?a-/�

Ú�-

Page 23: Load chracterization and anomaly detection for voice over IP traffic

�7BK-4$v&)(3$#�V-4$v?��� #-/13��?IEH #�!> �7B���>:�.?�� G (*��?=-/�+$\�5$#�+-4>:(*�7�5? F (3 +(3>��5�7�5 +$\(3��?=�K�3���5> F -4 +-/&)( G/G ,`$+���)P�����3�+B��� ����3 +?�$5U.�+B���>��.?�� G 03-/1!�5$�(��7BK +��$#B�� G ?:�7B�(*�v&)(3�:;Y��A�$#��?�(3$v(C0!A�-4?K��EH�3 $+�5�#�7-/��0'(*�I��> F -/ +-4&�( G�T1!�5 G �!(3?��7B� #��$+BK� G ?[P

¦bA FKF �!$#�6�7B^(*���+B�� G -/��"2$ F ����? -4$ G (3 #0!�����K�!A�0!B[U�$+(T, (*� G ��(3$#�V�+B��@$ F ���5?]�3E�(=� � F �! w�)Ul��BK-4&dB&��3 + +�5$ F �!��?�$��7�=(*;Y�!Ab��� � ª &)( G4G $S(*� � �:".;K-/�/�9$�P���B�-4$�0!A^(3 +(3�_�7�5��$��+B^(*��(*���+B�� G �_(3?�$S�3E��+B��'�3 +?��5 �3E[�+B�� G -4��"6$ F �5��?[U.�7B���?�-4$w�7 #-4;�AK�+-4�!�K$v�*E � � (3�K?I�7B���-4��$w�d(3�_�7(3�����3A�$�?^(9�d(` +(*�7��(3 +��( F�F +�)Lb-4>:(*�7� G ,���! #>I( G P�¦bA FKF �!$#�3U����v(3 #�0!-/13���C(�&��3��$#�7(3�_� � � 0 ��B�-/&dB`-/$l�7B��>:(9Lb-4>'A�> (*&�&�� F �d(*; G � F #�!;^(3;K- G -���,�3E��+B��Ws kK��qui3k^q�i3klpdh9�_�Z?^(9�d(y +(*�7�:��Lb&��5��?�-/��0W�7BK� G -/��"W$ F �5��? @PNxt��, F -4&�( G4G ,!U � -4$ 0 $ 0DÚ �! 0 $ 0 ¢bP {��B��5�M�+B���>I(9Lb-/>I( G (3&5&�� F �d(3; G � G -/��" G �_(3? $$�yxt-zP��*P/U�7BK��>:��(3�f�.AK>�;Y�5 6�3E�&)( G/G $'-/� F +�!03 +��$#$d{'-/$&��3> F Ab�7��?�EH +�3> $ � � &�� $ � * @ � $��B��5 +� &�-/$��7B���x Ú , � {�~��%A^(3�_�+- G ���3E��7B���$w�d(3�K?^(3 +?����3 +>:( G ?K-4$#�+ +-/;�AK�7-/�!�[P���BK�����7B��V�+B� +�5$+B�� G ? � �&)(*�y;<�Z&dB��!$+�5�[U^EH�! ���LK(3> F�G �3UKEH #�!>

� � @�x � �#{ � & � � x � � @�x � �#{#{�* $ � $� � ��������]�:���C������ �2� � ��� ��) ��� �� �!�� ��=��

���Z�+��$w��7B���>��5�+B��b?K$ F +� F �!$#��?@-4���+B�� F #�51.-4�!AK$$+��&��7-/�!��$�U!�\���!;K�7(3-4���5?6?^(*�7(�EH +�!> (3�6� F �� +(*�7-/�!�^( G����~�;^(*$+��? ���5���\�! #"f�+B^(*��&)(* + +-/��$@;<�3�7BM��� (3��?M���!��� �+ 7(*8�&3PM��B��y0!�����5 7( G (* +&dB�-��7��&��7A� #�y�*E��7BK����������! #"�-/$V$+-/>:- G (3 ��+�I�7B^(9��$+B��T���D��-/0!A� +� Ú ��-/�+B $+�50!>:�5�_�7$��+B^(*��&�(3 + w, F #-4>:(3 +- G ,=���3���O�+ 7(*8�&3P��B���?�(*�d(I&5�!�_�d(3-/��$�¢T~�>�-4�%AK�7�C-4� F AK�/�9�!AK� F AK��;_,%�7�'>:��(3$+A� #��>����_�7$ F �5 V-4�_�7�5 #Et(3&5��x�s �#£�k�¤�r�q�p�qH�S(*��?s �9¤��.q+¤�r�q�p�qH�'¦b§V��� �y��¥�$7{C&�� G4G �5&5�+��?c�T1!�5 �( F �� #-4�.?]�*E��!���:�\���5"�P���B��= #��$#A G �+-4��0y;%,%�+�=&��!AK�%�+$EH +�3> �7BK�Z���\�:��, F -/&)( G -4�_�7�5 #Et(3&5��$�U��!�K�VEH�! ��)(3&dBy�3E}����(3��?����!��� G �_(3?�$5UK���5 +�Z$+BK�����y-4�2��-/0!A� +�5$ ª(3��? �KP

Ú '

Page 24: Load chracterization and anomaly detection for voice over IP traffic

� EH�5� �3;�$+�5 #1*(*�7-/�!��$C(3 #�:-/�D�3 +?��5 CBK�� +�*P���-/ +$#�Z;<�3�+B]?^(9�d(�$+�5�+$`$#B��T� (�Et(*-4 �(3>��!A��_�C�3E\�7-4>���~��3E�~?^(),]?�� F ����?K����&5��(3��?a�+B��� #�5EH�! #�=���!�b~�����0 G -403-4; G ���7 +�5��?�$6(9�'1*(3 +-/�!A�$Z�7-/>:�5$`?�AK +-4�K0��)(*&dBN?^(),!PW���()1!�!-/?y�+B�� F +�!; G ��>�$S(3$+$#�b&5-�(*�+��?y��-��7B2���!�b~�$#�7(*�7-/�!�^(3 w,�?^(*�7(KU<(3��?��7B��'( F�F�G -4&)(*;�- G -/��,��3E��+B��'>��.?�� GF #��$+�5�_�7��? -4� ¦b��&��7-/�!� �bUv�\�yAK$+� Ú ¢W>:-/�.Ab�7��$��a�! 6�7BK +����&5�!��$+�5&�AK�+-/13��>��)(3$#A� +�5>:�5�%�+$��c(3$@�7BK�>:(9Lb-4>�A�> �7-/>:��?KA� +-/��0C��BK-4&dB�?^(*�d(���- G/G ;<��(*$+$+AK>:�5?I$#�7(*�7-/�!�^(3 w,6(3�K?�EH�! G (3 +03�� ���-4�K?��T��$v�\�S��- G4G?����7�� #>:-/�����7 #����?K$`(*��?X +��>��T1!�6�7BK��> EH�3 VEHA� #�+B��� Z(3��( G ,.$+-/$�P�¦b��&5�!��?[U�;^(3$#��?D�!� �7B��6-/�KEH�! +>:(*�+-4�!�EH +�3> �7BK�C���!���M��, F �Z�3E}$+�� w1.-4&�� F #��1.-/?���?2-4���7BK-4$����5���\�! #"<U^�\�'(*$+$+AK>:���7BK�C&5�b?K-4��0@�3E�1!�!-/&��Z-4$�(9�� �!"%; F $���-/�+B��!AK�S$#- G �5��&��C$+A F�F +�5$+$#-4�!� �! �B���(3?��5 �&��3> F #��$#$+-4�3�[U^��B�-4&dB��+�!0!���7B��5 S��-��7B �}���}U������(3��?y���J��13�� #B��)(3?K$V +�5$+A G �7$�-/�W()1!�5 7(303�';^(3�K?K��-4?K�+B F �� S���!����&)( G/G � Ú�ª - "%; F $�PS��B�-/ +?[U^�\��(3$#$+A�>���7BK�'()1!�5 7(303�`B�� G ?�-/��06�7-4>����3E�(�&�( G4G -/$ ª P ¢6>:-/�%AK�7�5$�P ��L F�G �!-/�+-4��0��+B�-4$�Et(3&��)U^�7BK�`;_,%�7�C&��!AK�%�S�7-/>:�$+�5 +-/��$I$#B��T���J-4� ��-40!AK +� �]&�(3��;<��&��3�%13�� w�7��?��+�N(]¡_¢�~�>�-4�%AK�+�y()13�� 7(*0!��&�( G4G &��3A��_�7¡ F #�b&5��$#$+��$5P��B�-/ +?[UK�\�V��- G/G �+ +��(*���7B���?�(*�d(6(3$�-�E�-/�\���5 +�Z&�� G/G �5&5�7�5?��!� G -4����(3��?2( F�F�G ,:�+B��V�7�5&dB���-/�.AK��$�(3$�$+AK&dB[U��-/�+B��!AK�S(*$+$+AK>:-/��06�7B^(*���+B�����B�� G �C$#�5�S-4$�()1*(3- G (3; G ��A F EH +�!�_�)P

�]��( F�F�G ,��7B��\�7��$w�7$ F +� F �!$+�5?6-4�@¦.��&5�+-4�!�6¢S�7�S�7B���()1*(3- G (3; G ��7 7(*&���$5P��-/ +$#��U9EH�3 }�7BK��( F�F�G -4&�(3;�- G -/��,��3E�7BK��>:���7B��.?�?��513� G � F �5?y-/�2¦b��&��7-/�!� ���7���7BK��$+�Z?^(9�d(�xt��, F �Z�v�}�5$#�d{�U � 0 ~�>:-/�%AK�7��$7(3> F�G ��13(* +-�(*��&��5$(3 #�'���! #>I( G -4e5��?�;_,� #��>��T1b-/��0=(*�%,��+ +���K?�$V(3�K?W +�5$+&)( G ��?y�7�=>:(*�7&dB $ * Ú � G (3��0 G �_(*?[PS��-40!AK +� �$+BK����$��7BK� F�G �3��3EY�7B������3 +>:( G -/e���?6$+(3> F�G ��1*(3 #-�(3��&5��$�3EY�7B������!��� F +�.&��5$+$�1!�� #$+A�$v�7B������3 +>:( G -/e���?1*(3 +-4(3��&5��EH +�3> ��-4�3 +?^(3��EH�! +>'A G (:x �_{|Ub�+B^(*��-/$�U%1*( G A����3E �7BK-4$\EH�3 +>�A G (ZEH�3 �('A��K-/� G �_(3?*$ * Ú P���$�-/�>:(T,@;<��$#���5�IEH +�!> �+B�-4$v0! 7( F B[U%�7B��5 +�V(* +� � ª ¢�1.-4� G (*�7-/�!��$���-/�+B�-4���7B��S���5��"�U�-zP��*P/U_�7BK���513���_�7$���BK����7BK�:1*(3 +-4(3��&5���|Lb&����5?�$��7BK� F #��?���¨^���5?c�7B� #��$+BK� G ?[P�� G $#�����3�+-4&5���+B^(*�C�7B��:()1!�� +(30!���7-4>��@;Y�������5����7BK�`1.-4� G (*�7-/�!��$�-/$ ��� 0 0 >�-4�%AK�+��$'x - 0 �7-4>��ZA���-��7$d{�A���-��7$5P��^A� w�7B��5 �U��7B��5$+��-/�%�+�� w13( G $�(3 +�`$ F #�)(3?��+��7BK�� #-40!B_���-/�+BI( G �!��0!�5 ��7(3- G P}����&��3�%�+ 7(3$w�)U%�7B������a�+ 7(*8�&�B^(3$ � ��� ' 0 1.-4� G (*�7-/�!��$�U*��-/�7B6�+B���()13�� 7(*0!��7-/>:�S;<�5���\�������7BK��> � ' 0 >�-4�%AK�+��$Vx Ú�- �+-4>���AK��-/�+$d{�U.��-/�+B�-4�_�7�5 #1*( G $v& G �!$+� G ,�& G A�$#�+�� #��?2(3 +�3A���?=�7BK�>��)(3�[P ��BK��$+��?^(9�d( (3 #�=$+B��T���f-4�N?K�5�d(*- G �5?c-4�c��-40!AK +� - U�EH +�!> ��B�-4&dBc�\��&��3��& G A�?��=�7B�(*�����!����7 +(*8�&�¨��7$��7BK�Z1*(3 #-�(3�K&�����$w�7-/>I(*�+�VEH +�!>�x �_{�>'A�&dBy;<�5�#�7�5 ��+B^(3�2��� �7 +(*8�&Z?��b�5$�P

� ��������������������� �����!���#"%$�&'������� ( ��"�)*�����!+,$-�#&/.1032 4��%$-�!5%�!����)#576�8�214%�%$���"%(9�;:#+<���#)#+�5�����(��="�)����=��+<$����>���@?���=" � ��+<$/$A5%�3BC$!�����������D��+<$!���=��$<EGF����D+�H��#���%�=+�IJBK�=�!5L��5�+<$!+M:3�#�=��+,$K��5�+-���#���!+,$A�N�#"%(��="�)O�%�=�#��$K���PFQ��)#����+<$R6��!5����#�%)#5S<T I "����G$!5��3BK"UI +,$V�W��4�����$!5�+�H��#���!��XO�!5�+Y$�����+Z��+<$!���[�W$G( +,$!���!��4J+,(\5%+���+#E

ª 0

Page 25: Load chracterization and anomaly detection for voice over IP traffic

0

0.2

0.4

0.6

0.8

1

0 50 100 150 200 250 300 350 400 450 500

Pr

{ x

> t }

Time (unit is 5 minutes)

’Voice over IP’’IP’

��-/0!A� +� - # � °g¾p¹�¼£®+¾p®+±f·´Á ¶ºÃ]¯�Ë�¾3Ëa¼�Á ·´³½Ì¬®^µa³�²À·À¶º³½»�Ëa·´³½°g±a²`°¬¿a·´¸�®^·´³£¾p®^³�±f·À®�¶´Ì Á¬¼£²�Õ ³£±�×�¾j³£±-Ë�·À®�Ëa±a³½·´²�Õh»z®�·_Æ�®�®+±¯�°g±a²À®+¯�Ëa·´³½Ì¬®¢Ì@³½°g¼£Á ·´³½°g±a²B¿Î°¬¶ �d°¬Ä�Å � ·À°¬¹ �BÁ¬±aµ1Ä�Å � »z°¬·À·À°g¾ �ÒÕD²À®�®��|³½ÐgË�¶´®+² �pÁ¬±aµ��YÈ

ªDÚ

Page 26: Load chracterization and anomaly detection for voice over IP traffic

Q�()1.-4�K0 F (3$+$#��?a����$w�C�3Ev�v, F �:��EH�! V���!�����+ 7(*8�&*U[��� F #�b&5����?X�7��$#�5�Z�7B��@�T1!�5 �*AK��?��� G �_(*?];^(*��?A�$#-4��02�v, F �:�#������$w�`EH�! V���3�����7 +(3&��*PI��-/0!A� #� ' $#B��T��$C�+B�� F +�3¨ G �6�3E��+B��@?^(*�7(��+�!0!�5�+B��� ���-��7BD(&��3�K¨^?��5��&��@;^(3�K?WEH�! ��+B�-4$�( G (3 #>yP���B��6&��!�b¨^?����K&��@;^(3��? -/$�1*( G -4?�AK��?��� V�+B��6(3$#$+A�> F �+-4�!�W�*E ª P ¢�~>�-4�%AK�7�5$�&)( G/G B�� G ?K-4��0��7-/>:����-��7B:(T13�� +(30!-4�K0`-/�%�+�� w13( G �3E Ú ¢�~ � 0 >:-/�%AK�7�5$�P��]���3;�$+�5 #1!�S�7B^(9�\��-��7B:(3���L F ��&��d(*�+-4�!�W�*E �`¢ � �3E�?^(*�d(�Et( G4G -4��06�!Ab�7$+-/?��`�+B�-4$�(3?^( F �7-/13�`;�(3��?[U � ��� �3E��+B��`���3���O>��)(*$+A� #��??^(*�7(VEt( G4G �!AK�7$#-4?����+B�����-4��?��T�ZU%(30!(3-4�@&��3�K¨^ +>�-4�K0V�7B��� +��(3$+�3�^(3; G �����5$+$��3E<�7B���¨��v�3EY>:�.?�� G �7�����!����7 +(3&��*P�xt��B��Z&��3�K¨^?��5��&��`;^(3��?�EH�! ���� -/$�$+B��T����-/�2��-40!AK +� Ú10 EH�! �&5�!> F�G ���7���K��$+$5P {

� ��� � � �����

�]��?��� #-/1!�5?2EH�3 +>�A G (3��EH�3 ��7B��V1*(3 #-�(3�K&��V�3E��+B��Z&�A�>�A G (*�+-/1!���7 7(98:&���13�� �¨KLb��?2-4�_�+�� #1*( G $�EH�! �('13�� w,0!�5���� +( G >��.?�� G �3E�?^(9�d(2�+ 7(*8�&*P��^�! Z1!�!-/&��:��13�� ���� �7 +(*8�&3U��7B�-/$`EH�! #>�A G (�-4$Z1!�5 #,]$+-/> F�G �I(*��?a-/$"%���T���D(3$��+B�� ��-4�! #?^(3��EH�! #>�A G (KP���� F +�T1.-4?��5$�(3�fxt(3�^( G ,%�7-4&�( G {��5$#�7-/>I(9�7�`EH�3 ��7BK�'1*(3 +-4(3��&��`�3E�7BK����!��� G �!(3?2�+B^(*� F (3$#$+��$S�7B� #�!A�0!BW(:$#��-��7&dBW�3 � #�!AK�7�5 �-/�_�7�� wEt(3&��*PS¦.�d(*��?^(3 #?W +�!Ab�7�� S>��)(3$#A� +�5>:�5�%�+$xt$#A�&dB (3$@¦K§���� �y��¥�¦�{�( G $#� F #��1.-/?���(3?��5�.A�(*�7��?^(9�d(��7� �5$#�+-4>:(*�7���7B��=1*(3 #-�(3��&5�I�3E��+B��=�7 +(*8�&?�-/ +��&�� G ,!PS��B���$#�������=�5$#�+-4>:(*�7�5$�&)(*���7B��5� ;Y�`A�$+�5?W�7�=?K�5�7�5 +>�-4���`-/E}�7B��5 +��-/$V(30! #���5>:�5�%��;Y�������5����7BK�6>:�.?�� G (3��?X?^(9�d(KUl(3��?X-/E�$#��U F #��1.-/?��@(3� -4�K?�-4&�(*�7-/�!���3E G �_(3? (*���!>:( G -/��$���-/�7BK-4�W�7BK�����5���\�! #"$+�50!>����_����B��� #�C�+ 7(*8�&Z-4$�>��)(3$#A� +�5?[P���B��Z +�5$+A G �7-4�K0�>��5�+B��.?2-/$�( G $#�@A�$+�5?2�+�:?����7�5&5�S�T1!�� G �_(*?[P

�]���|LK(3>:-/����?X�7BK�:( F�F�G -/&)(3;K- G -���,��3E��+B�-4$�$#&dB���>��@�7�2(2?�(*�d(�$+���'�*E\¨^� G ?D>:��(3$+AK +��>����_�+$C�*E����!����7 +(*8�&@(3��? $#B��T���5?a(=0!�.�.?W>I(9�7&dBX;Y�������5���X�7B��@(*�^( G ,%�+-4&)( G >��.?�� G (3��? �7B��'>:��(3$+A� #��>����_�7$5P'���EHA� w�7B��5 :�7�5$#�=�+B���AK$7(3;�- G -���,f�3EV�7BK-4$I$#&dB���>����\� ( G $+�c( F�F�G -/��? -/���7�a>��)(*$+A� #��>����_�7$IEH #�!> (3� ���-4�_�+�� #Et(*&��W�7B�(*����(*$y$#B��T��� �+�M;<� >�A�&dB G �5$+$�&��3��$+-/$#�7�5�_�2��-��7BJ�7BK�D>��.?�� G P �]� & G (*$+$+-�¨^��?O�7BK�

F #�b&5��?�A� #�:-/�_�7�=�7BK +���@�7�5$#�+$C�3 Z( G (3 #>:$5P���, F ���V( G (3 +> -4��?K-4&)(9�7��$V�+B^(*�Z�7BK�@�+ 7(*8�&6-/$�A�� G -/"3� G ,��+�;<�V���!���}P���, F �C�+�v( G (3 +> -4�K?�-4&�(*�7�5$�(3���!>:( G �3A�$ G �_(3?=&dB^(*��0!�C(3��?�-4$�( F�F�G -/��?=�3� G ,:��B����y( G (* +> �3E��, F �Z�v-4$����*��$+�5��Pv��-4�^( G4G ,3UK( G (3 #> �3E���, F �`�#�+�v-4$�$#�5�S�!� G ,I��B��5�2�+B��� #�C-/$��T1!�� G �_(*?[P��B�-4$�( G (3 #> -/$( G $+�@$+�����3� G ,:��B�����( G (3 #> �*E}��, F �`�v-4$����*��$#�5��P

ª!ª

Page 27: Load chracterization and anomaly detection for voice over IP traffic

��-/0!A� +� ' #�� ×���¯�°g±@ÓDµa®+±a¯�®O»�Á¬±�µj¿Î°¬¶ �d°¬Ä�Å·À¶ºÁLÂ�¯�²´¸�°©Æ�³£±�Ð ���V°¬¿�·´¸a®�µaÁ ·´Á3¿ÎÁ¬¼�¼£²d°gË�·´²´³�µ�®O·´¸�®�»�Á¬±aµ � ²À®�®ÉHÁ »�¼½® � �

��-/0!A� +� Ú10 #�� ×��/¯�°g±@Ó`µ�®+±a¯�®�»�Á¬±aµl¿�°¬¶]·´¸�®�Ä�Ås·À¶ºÁLÂ�¯ Õ�·À¶´®+Á ·´³�±�Ð�·´¸�®�Ä>Ås·À¶ºÁLÂ�¯�Á¬²]³½¿^³½·�Æ�®�¶´®��d°g³£¯�®p°h̬®�¶Ä�ÅPÈ�� ¼£Á ¶ºÐ¬®¢¿�¶ÒÁ¬¯�·´³½°g±1°¬¿H·´¸�®�µaÁ ·´Áp¹z°g³£±Y·´²B¿rÁ¬¼£¼z°gË�·´²´³£µa®)·´¸�®¢¯�°g±@ÓDµ�®+±�¯�®¢»�Á¬±aµ�È

ª �

Page 28: Load chracterization and anomaly detection for voice over IP traffic

�]�`�|L F ��&����+B^(*���7B��C0!�5���� +( G 13(* +-�(*��&���EH�! #>�A G (*�V���!A G ?2;Y�CA�$+��EHA G -4��?��5�+��&��7-4�3���3E�(3���!>:( G -/��$�EH�3 �7BK�C>��! #��0!�����5 7( G ���M�7 7(98:&*P���B�-4$�-/$��+B��Z$+A�; �#��&5���3E�EHAK�7AK +�Z +�5$+�)(* +&dB[P

� � � � V� �����+� �������^��� � ���� ���� �� ��� ��'�� �!�2� �`������� �'�

� ��� �� ���� V��� �)�=� �� � ���

��-/0!A� +� Ú@Ú $+B��T��$��7B�� F�G �3���3E`$#�7(3��?^(* +?O?��51.-4(*�7-/�!�J�3EC�7B��X� !Y�� #��? G �_(*?O(3$�(cEHA���&5�+-4�!�O�3EC�7BK����! #>I( G -4e5��?:(30!0! #��0_(9�7-4�3��-/�_�7�� w1*( G � JEH�! �( G �_(*?I�3E Ú �� G (3��03$�-4���7B�� �S-/�! +?�(3��EH�3 +>�A G (KP���$�-���&�(3�;<�C$#���5�[U^�7B�� G (* +0!�5 ��7B��C(3030! +�50_(*�7-/�!��-4�_�+�� #1*( G Ub�+B��Z;Y���+�7�5 ��7B��Z��$w�7-/>I(*�+���3E��7B�� G �!(3?[U

G -4>� ! � < � , Ú �� � * Úª $ $

�]�I$+�5�I�7B�(*�'��-��7B]13�� w,c$+BK�! #�'>:��(3$+A� #��>����_�7$`�7B���13(* +-�(*��&���-4$ �#A�$#�,$ x ��B�-4&dBa-4$ G �!0!-/&)( G U�(3$'�7BK��%A�>�;<�� C�3E�&�( G4G $ � � B^(3$`(����!-4$#$+�!�]?�-4$w�7 +-/;�AK�+-4�!� ��-/�+B]>��)(*� $ (3�K?]1*(3 +-4(3��&5� $.{|PI�a�I( G $#��¨^��?�7B�(*���7B���1*(3 #-�(3��&5��?���&�(),b$S�7�@e��5 +��U^�5$+$#���_�7-4( G4G , G -/"3� � < $Q��T�\�513�� �U �+B������5��? EH�! V( G (3 #0!�'-/�%�+�� w13( G EH�! V(3� (3&5&�A� +(*�7�6�5$#�7-/>I(9�7�'�*E�7B��'1*(3 #-�(3�K&��'�K����?K$V�7��;<�;^( G (3��&5��?�(30_(3-/��$#��+B��������5?��+�Z$+�5�\( G (3 +>�$��%A�-/&d" G ,���B��5�=(3��(3���3>I( G ,'-/$?��5�+��&��7��?lP����3 ��7B�� G (9�+�7�5 �U�7BK�I$+BK�! #�+�� '�+B��=(3030! +�50_(*�7-/�!�D-4�_�7�5 #1*( G U��7BK�I;<�5�+�+�� 5P���B��:� F �7-/>I( G �7 7(*?���~�� !M;Y�������5���N�7B��5$+�I���\��7�5��?��5��&�-/��$Z?�� F ���K?�$`�3� $+�!>��6�%A^(3�_�7-�¨^&)(*�+-4�!� �*Ev�+B��6A� #0!����&�, �3E\( G (3 +> $+���7$�1!�5 +$+AK$'(3&5&�A� +(3&5,��3E�7BK�`( G (3 #>:$5UK0!-�1!�����7BK�Z��, F �Z��(3��?2�+�v�� # +�! #$�?�-4$#&�A�$#$+��?y�)(3 G -/�� �P

��� V�!V� � �

� Ú�� �]P��B��3�#�d(3�lU�(3��? ©�P��3-uP���K�!>I( G , �V���7�5&5�7-/�!�M-4�M��� §��5���\�! #".$5P�£� � � ��K�+i3kK� ��h9k���s �3k<i3g�\�dhTrdpd�d��s k��3U.��� �P�¢ Ú U�§ � P - U^��AK0�P ª 0 0 �KU F�F ªDÚ '`Ú ~ ª!ª 0 ��P

ª �

Page 29: Load chracterization and anomaly detection for voice over IP traffic

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0 5 10 15 20 25 30

2*(exp(-x)-1+x)/(x**2)

��-/0!A� +� Ú@Ú #�� ²À·´³�¾jÁ ·À®)°¬¿P·´¸a®¢²À·´Á¬±aµaÁ ¶ºµ1µa®�Ì-³£Á ·´³£°g±�°¬¿P·´¸�®)°��z®�¶´®+µ�¼£°gÁ¬µ�°¬¿��]®�¶º¼�Á¬±�Ðg²*Á¬²�Á�¿rËa±a¯�·´³½°g±�°¬¿H·´¸�®±�°¬¶º¾�Á¬¼£³���®+µ�Á Ð¬Ð¬¶´®�ÐgÁ ·´³½°g±�³£±Y·À®�¶´Ì Á¬¼�����ÒÕK²´®�®j¿�°¬¶Ò¾3Ëa¼�Á � � �ÒÈ � ��°¬¶�®�Ô@Á¬¾j¹�¼½®¬ÕK·À°�¶´®+Á¬µ�°��Ö·´¸�®�²À·´Á¬±�µaÁ ¶ºµµ�®�Ì@³£Á ·´³½°g±3¿�°¬¶|¼½°gÁ¬µ3°¬¿D×�� �u®�¶º¼£Á¬±�Ðg²+ÕL¿Î°¬¶H·´¸�®�Á©Ì¬®�¶ºÁ Ð¬®�¸�°g¼£µ�³£±�Ð�·´³£¾j® ������ ���������½ÕgÁ¬±aµ�·À°¬·´Á¬¼@¼½°gÁ¬µ�¾p®+Á¬²ºË�¶´®+µ³£±�»YÃ-·À®+²H®�̬®�¶´Ã�����×��������½Õ ·´¸�®�ÌLÁ¬¼£Ëa®^É �)×gØ ����� È � � ��³�²K¶´®+Á¬µ3°g±3·´¸�® Ô-Ê_ÁLÔ�³£²�Õ¬Á¬±aµ¢·´¸a®�¯�°¬¶´¶º®+²À¹z°g±aµa³£±�Ð*ÃYÊ_ÁLÔ�³£²Ì Á¬¼£Ë�®)°¬¿�� �@È! j³£²*¾�Ëa¼½·´³£¹�¼£³½®+µ�»YÃ1×�� � !#" $ �&%'%(� � �-Õ`Ðg³½Ì@³£±�Ð�·´¸�®¢²À·´Á¬±�µaÁ ¶ºµ�µ�®�Ì@³£Á ·´³½°g±�°¬¿)�* p¯�Á¬¼�¼£²

� ª�� ©�P^Q��.�.?[U^(3��?y©�P �3-zP�� +�_(*&5�7-�1!�Z���������! #"=Et(3A G ��?��5�+��&��7-4�3�[P �\�7hTr � £ � � £,+�1�¤�-�¤ .�Ub��� G P$�KU/��!;Y�*U �!( F (*�[U^� F 5P Ú ' ' �.U F�F P Ú-Ú � ��~ Ú@Ú ¢!¢bP

� � � �CP9��?K?�-4�*U_�}P3��(3���K�� +$+( G �KU_(3��?6�dP3§��! # +�!$5P3���� #EH�3 +>:(3��&��\EH�! +>�A G (3��EH�! ��%A��5A���$���-��7B �Z(3A�$#$+-4(3�-4� F AK�)P �\�7hTrdpdp+j3s k��9�S£ �0-21439U Ú@Ú � ' � Ú-Ú � - U Ú ' ' ' P

� � � ��Pb¥����K��$�U}��B��Z©��T1*(3 +-4(3��&5��EHA���&��7-/�!�I�3E�(C$+-/> F�G �S�+ +A��K"�03 +�!A F Ub��-/�+B=( FKF�G -/&)(*�+-4�!��$�+�'�7 +(*8�&>:��(3$+AK +��>����_��U65Vp�g g ��nT��q�p�m �<pdr 2 �87 �4U Ú ' � Ú U F�F P Ú@Ú ��~ Ú � - P

� ¢ � §`P �VAb8:� G ?[P:9VA���A��5-4��0�(*� G (3 #0!�V +�5$+�!AK +&��5$�?K +-/13����;_, G �3��0*~��7(3- G ��?=� � � � .M~�>��b?KA G (*�+��? F +�*~&��5$+$+�5$�P ;���p��^p�s k�� ��nT��q�p�m'� � ª - # ª �%¢ � ª � �KU Ú ' ' - P

� � � �P�Q���U ��PS©�()1.AK�7�KUC¦YPS��( F ()1*(3$#$+- G -4�!AlUV�'P=<[()��(*?�e�"%-uU ��?�( F �7-�1!� �*��AK�+�!>:(*�7�5? �V���7��&��7-/�!��3E�¦b�5 #1.-4&5�������!>:( G -4��$C-4�a�} +(3��$7(*&5�7-/�!�b~ � #-4�5�%�+��?a�W�V§V¦ #§��������! #"a���^( G ,.$#-4$�U� G 0!�3 +-/�+B�>�$�U��> FKG ��>����_�7(*�7-/�!��(3��? �V� FKG �T,.>:�5�%��U\£ � � 7^h9�.�|k<i3g}h9k �[p�g4pdr�q�p+j?>��dp+i9�6h��@-\h9m6m6�.k^sur+i3qtsuh9k �1!� G P Ú�- U�§���P��bU ª 0 0 0 P

ª ¢

Page 30: Load chracterization and anomaly detection for voice over IP traffic

� � � � P � � G (*��?[U��DPS�}(3�%�%A[UV� P��O- G/G -4�K0!�� 5U�(3��? ��P\�O- G $#�!�[P � �O�7B��D$+� G E�~�$+-4>�- G (3 ��^(*�7AK +�X�3E���7B��5 +�����S�+ 7(*8�&*P<£ � � �� > - . ���#i3kK��i.r�qtsuh9kK�'h9k +Cp�q 5�h9� �9s k��3U ª # Ú � Ú ¢.U Ú ' ' ��P

� - � �CPK��(9Lb-/�!�[U^��Pb�^�)(*�+B��� 5U���&�(3$+��$w�7A�?K,I�3E����7B��5 +������(3���!>:( G -/��$v-4��(�?K-4$#�+ +-/;�AK�7�5?=&��3> F Ab�7-4�K0���_1.-4 #�!��>����_�)Uv£� � � ���#i3kK��i.r�qtsuh9kK�'h9k���p�gosti���s gos qtn � 1!� G P�� ' U � &��)P Ú ' ' 0 U F�F P � � �9~ � � �KP

� ' � �KP �S-/�! +?^(*�[U=��� G � F B��!�K�:�� 7(*8�&:��-4>����S1!�5 7(30!�5$�U 5Vp�g g ��nT��q�p�m �<pdr 2 � 7%�4U���� G P�� ' U�x Ú ' ¢ Ú {�UF�F P Ú@ÚTª ' ~ Ú-Ú � ��P

� Ú10 � ��Pb¦.�7�T,_(*�[Ub� P ¦YP /Z�5��?^( G/G U �KPK�y��&d"*�3P���q�hTr 2Ki9��qtsur���pdh9mIp�qz�|n�i3k<j�s qH� >����<gosur+i3qzsuh9kK��x ª ��?:��?�{|U�O- G �5,!U Ú ' ' ¢.P

� Ú@Ú�� /6P^��B��!> F $+�!�lU��6P<�y- G/G �5 �U^(3�K? �ZP��O- G ?��5 �Pv�O-4?��`(3 +��(�-/�_�7�� #���5�S�7 +(*8�& F (*�+�+�� +�K$V(3��?y&dB^(3 �~(3&5�+�� #-4$#�+-4&5$I£� � � 2+Cp�q 5�h9� �9U�§S�T1YP Ú ' ' �bP

� Ú�ª�� �]P_��B��3�#�d(3�I(3��?I©�P �3-uP%� +�_(*&5�7-�1!�S(3���3>I( G ,�?����7�5&5�7-/�!��A�$+-/��0`?K-4$#�+ +-/;�AK�7�5?:-/�_�7� G/G -/0!���_��(303���_�7$5U£ � � 2+`p�q 5�h9���9U<¦ F ��&�-4( G -/$+$+AK�C�3��§S�5���\�! +"2��(*�^(30!�5>:�5�%��U Ú ' ' -

ª �