Characterization of Host-Level Application Traffic with Multi-Scale Gamma Model

In this paper, we discuss the validity of the multi-scale gamma model and characterize the differences in host-level application traffic with this model by using a real traffic trace collected on a 150-Mbps transpacific link. First, we investigate the dependency of the model (parameters α and β, and fitting accuracy ) on time scale Δ, then find suitable time scales for the model. Second, we inspect the relations among α, β, and , in order to characterize the differences in the types of applications. The main findings of the paper are as follows. (1) Different types of applications show different dependencies of α, β, and on Δ, and display different suitable Δs for the model. The model is more accurate if the traffic consists of intermittently-sent packets than other. (2) More appropriate models are obtained with specific α and β values (e.g., 0.1 < α < 1, and β < 2 for Δ = 500 ms). Also, application-specific traffic presents specific ranges of α, β, and for each Δ, so that these characteristics can be used in application identification methods such as anomaly detection and other machine learning methods. key words: traffic analysis, model evaluation, traffic characterization, multi-scale gamma model