Research On The Self-similarity Of Network Traffic

Since the seminal study of Leland, Taqqu, Willinger, and Wilson who pointed out the existence of scaling behavior in the network traffic, the so-called self-similarity, there is now ample evidence that scale-invariant burstiness is an ubiquitous phenomenon in a wide range of generalized data types, from local-area and wide-area networks to IP and ATM protocol stacks to copper and fiber optic transmission media.Hurst parameter is a very important parameter to evaluate network self-similarity. In this paper, a new method to estimate the Hurst parameter of the increment process in network traffic–a process that is assumed to be self-similar is presented. The confidence intervals are obtained for the estimates using the new method. This new method is then applied to pseudo-random data and to real traffic data. We compare the performance of the new method to that of the widely-used wavelet method, and demonstrate that the former is much faster and produces much smaller confidence intervals of the Hurst parameter estimate. And then the estimation based on Hurst parameter is used to detect DoS attack, researched on the affect of Hurst parameter change brought by DoS attack. By analyzing the 1998 DARPA Intrusion Detection Evaluation dataset, it is verify that this method can detect DoS attack, and is more reliable on the recognition of all kinds of DoS attack than any other method based on measure precision.The existence of self-similarity shows that Poisson or Markov process cannot accurately describe the real network traffic. In this paper, the traffic prediction on self-similarity is researched. Least Mean Kurtosis (LMK) based on QPSO, which can obtain signal error ratio less than LMK, is proposed to predict the self similar traffic. The simulation results with the real traffic traces show the accuracy efficiency of the model.