Estimating Flow Length Distributions Using Least Square Method and Maximum Likelihood Estimation

Traffic sampling technology has been widely deployed in front of many high-speed network applications to alleviate the great pressure on packet capturing. However, knowing the number and length of the original flows is necessary for some applications. This paper provides a novel method that uses flow statistics formed from sampled packet stream to infer the absolute frequencies of lengths of flows in the unsampled stream. First, flows are classified as small (S) or large (L) based on their probability that no packet is sampled. For large flows we use maximum likelihood estimation to infer their length distribution, and for short flows we apply least square method. The theoretical analysis shows that the computational complexity of this method is well under control, and the experiment results demonstrate the inferred distributions are as accurate as EM algorithm.